Gittea Actions Artifact V4 API Unbounded Request Body DoS Vulnerability Analysis & POC

Gittea Actions Artifact V4 API Vulnerability Summary Vulnerability Overview Vulnerability Name: Unbounded Request Body Reading in Gittea Actions Artifact V4 API Leading to Memory Exhaustion DoS Vulnerability Type: Denial of Service (DoS) CVSS Score: 6.5 / 10 (Medium) Root Cause: The function does not limit memory usage when parsing the HTTP request body. Attackers can craft malformed requests to trigger infinite recursion or memory exhaustion. Affected Component: The function within the package. Scope of Impact Affected Versions: - All versions of (as of the report release) - Specifically affected Gittea versions: - through (inclusive) - and later versions have been patched Affected Platforms: - Instances utilizing Gittea Actions - Specifically CI/CD pipelines with the Artifact V4 API enabled Remediation Official Recommended Fix: - Upgrade Gittea to or a higher version. - If immediate upgrading is not possible, manually modify the function to enforce a request body size limit before parsing (e.g., limit to 1MB). Temporary Mitigation Measures: - Configure request body size limits at the reverse proxy layer (e.g., Nginx, Caddy). - Disable or restrict access permissions for the Artifact V4 API. POC Code / Exploitation Code > Note: The actual POC must be constructed based on the specific protobuf structure; the above is illustrative code. Real-world exploitation requires integration with Gittea's internal implementation details. Additional Information Reporter: @gittea Disclosure Date: 2024 (inferred from page context) Related CVE: None (No CVE number provided on the page)

Goal Reached Thanks to every supporter — we hit 100%!

Gittea Actions Artifact V4 API Unbounded Request Body DoS Vulnerability Analysis & POC

More from this source