GitBucket SSRF Vulnerability (CVE-918) via Unchecked Git Clone URL Analysis and PoC

Vulnerability Overview Vulnerability Name: SSRF via Unchecked Git Clone URL in Repository Creation #4044 Vulnerability Type: Server-Side Request Forgery (SSRF) Affected Version: 4.38.4 Deployment Mode: Docker 4.40.1 Problem Description: Package: gitbucket CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE: CVE-918 – Server-Side Request Forgery (SSRF) GitHub Advisory: Summary: GitBucket allows authenticated users to create new repositories by cloning an existing Git repository. The URL provided by the user is passed directly to JGit’s method without any validation or blocking checks. This allows any user with repository creation permissions (granted to all users by default) to force GitBucket to send outbound HTTP/HTTPS requests to arbitrary hosts and ports, including internal network infrastructure and cloud metadata services. Details: The vulnerability exists in at line 96. When a user selects the "Copy Existing Git Repository" option ( ) and provides a , this URL is passed directly to JGit's clone operation. JGit immediately sends an outbound HTTP GET request to the using the protocol with a header, before authentication or repository content checks. There is no URL validation, no scheme restriction, no hostname blocklist, and no whitelist applied to the . The webhook setting "Block sending to private addresses" ( ) only protects outbound webhook calls and does not apply to this code path. The repository creation form can be accessed via using the form fields and . This endpoint is open to all authenticated users when the default "All users" setting is active (which is the default in fresh GitBucket installations). PoC: Prerequisites: A GitBucket account with repository creation permissions (all registered users have this by default). Steps: 1. Start a listener on a server controlled by the attacker. 2. Send a POST request to the new repository endpoint. 3. The GitBucket server will send the request within seconds. Code Block: Live Reproduction (Docker Environment): Impact: Any authenticated GitBucket user can force the server to send outbound HTTP/HTTPS requests to arbitrary URLs without restriction. On cloud-hosted instances, this exposes cloud metadata endpoints (AWS IMDSv1, GCP Metadata, Azure IMDS), potentially leading to credential theft and compromise of the entire cloud account. On any deployment, it allows internal network reconnaissance and interaction with internal services. GitBucket’s default configuration allows all registered users to create repositories, making instances exploitable across all accounts. Scope of Impact Affected Versions: 4.38.4 Deployment Mode: Docker 4.40.1 Affected Users: All users with repository creation permissions (all registered users by default) Remediation Recommendation: Add an option to disable the feature and restrict target URLs. Actions Taken: - Added an option to disable repository creation via cloning. - Added private address blocking and IP whitelisting for repository cloning. Related Issues: #4054: Add an option to disable repository creation via cloning. #4056: Private address blocking and IP whitelisting for repository cloning. Status: Closed, marked as Completed.

Goal Reached Thanks to every supporter — we hit 100%!

GitBucket SSRF Vulnerability (CVE-918) via Unchecked Git Clone URL Analysis and PoC

More from this source