A vulnerability, which was classified as critical, was found in Gitea up to 1.5.3. Affected is an unknown part of the file go-macaron/session of the component Session ID Handler. The manipulation with an unknown input leads to a session fixiation vulnerability. CWE is classifying the issue as CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.

The bug was discovered 10/22/2018. The weakness was shared 11/04/2018 (Website). The advisory is shared for download at github.com. This vulnerability is traded as CVE-2018-18926 since 11/04/2018. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 13 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 1.5.4 eliminates this vulnerability.

Productinfo

Name

• Gitea

Version

• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion