CVE-2025-5784: Gitea Repository Migration SSRF Allows Internal Git Exfiltration via HTTP Redirect Bypass

Vulnerability Overview Vulnerability Name: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration CVE ID: CVE-2025-5784 Severity: High (8.5/10) Description: Gitea performs URL allow/block validation on user-provided repository migration URLs; however, during the actual cloning and subsequent mirror fetching operations, the Git client follows HTTP redirects. This leads to a URL policy bypass, SSRF (Server-Side Request Forgery), and leakage of internal Git repository information. Low-privilege authenticated users can submit a publicly allowed Git URL that redirects to an internal Git HTTP(S) endpoint inaccessible to the Gitea server. Local verification confirmed that Git follows a single redirect to , retrieves Git objects, and completes the clone. Primary Impact: Leakage of internal Git repository information to a Git repository controlled by the attacker. Mirror fetching increases the risk, as the scheduled operation can follow redirects and collect subsequent internal objects. For internet-accessible instances with migration enabled, this vulnerability defaults to High severity and can become Critical if internal repositories contain deployment keys, CI/CD keys, cloud credentials, Terraform state, kubeconfig, signing materials, or production configurations. Direct unauthorized exploitation, direct Git server RCE, arbitrary imports, and default Actions runner execution have not been confirmed. Affected Versions Affected Versions: (Go) <= 1.26.4 Patched Versions: (Go) 1.27.0 Attack Vector: Network Attack Complexity: Low Required Privileges: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: Low Availability: None Key Prerequisites: Repository migration is enabled (default). The attacker possesses a low-privilege account or the instance allows self-registration. Mirror fetching must be enabled for persistent information leakage. The Gitea server has access to internal Git HTTP(S) services that are not directly accessible by the attacker. High-Value Targets: Internal Gitea, GitLab, GitHub Enterprise, Bitbucket, cgit, git-http-backend, and static bare Git repositories. Repositories containing CI/CD definitions, deployment manifests, IaC credentials, or production configurations. Remediation Recommended Remediation: Disable Git HTTP redirects during repository migration clone and mirror fetching operations unless each redirect URL is explicitly revalidated under the same migration allow/block policy. Specific Code Modifications: Verification Steps: Local security PoC utilizes two HTTP services: a redirect service (representing an attacker-controlled public URL) and a target service (representing an internal Git HTTP repository). Observed being invoked pointing to the redirect URL; the redirector returns a single redirect to the internal target URL. Git follows the redirect, the internal target receives the request, the clone completes successfully, and the cloned repository contains the expected file content. Mirror fetching behavior was also verified locally: bare remote mirror configured to point to the redirect URL. follows the redirect to the internal target, the target receives object requests, and the mirror successfully fetches the expected branch references. Mitigation behavior disabling Git HTTP redirects was verified: cloning fails and returns an HTTP 302 error. Additional Verification: Attempts to redirect via through HTTP redirects resulted in Git rejecting the redirect to a local file protocol. Based on this verification, this report does not exclude arbitrary binary local filesystem reading or local repository imports via redirects. Verification Scope: Local PoC verified the security-critical Git network behavior: Git clone/fetch follows redirects and retrieves repository objects from internal redirect targets. Code review verified that Gitea's migration handler passes the validated clone URL to the Git clone/fetch path without disabling HTTP redirects. A full Gitea UI/API end-to-end exploitation was not executed as part of this report. For additional assurance, before submission, one can POST to or with a redirect URL and confirm that the attacker-controlled Gitea repository contains the content of the internal repository. For mirror mode, add a new commit to the internal target and confirm that the subsequent mirror sync imports it. Impact Assessment: Confirmed impact is server-side Git network access redirecting to the target, resulting in internal Git repository information leakage when the redirect target is accessible. This may expose private source code, complete Git history, deleted keys, internal deployments, deployment pipelines, service names, and future commits if mirror fetching continues to synchronize. The highest-risk secondary impact is secret extraction. Internal repositories typically contain CI/CD definitions, deployment scripts, kubeconfig, Terraform state, cloud keys, registry keys

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-5784: Gitea Repository Migration SSRF Allows Internal Git Exfiltration via HTTP Redirect Bypass

More from this source