| शीर्षक | Forgejo 15.0.4 SSRF |
|---|
| विवरण | Forgejo restricts repository migration and mirror sources by rejecting loopback and private
network destinations. This protection relies on a DNS lookup performed during URL validation
(net.LookupIP).
For plain Git migrations, however, the actual clone is performed by an external git
subprocess. That subprocess performs its own DNS resolution when establishing the network
connection and is not protected by Forgejo's connect-time IP validation
(hostmatcher.NewDialContext).
Because validation and connection perform independent DNS resolutions, an attacker controlling
DNS responses (DNS rebinding) can return:
a public IP during Forgejo's validation (request accepted), then
127.0.0.1 or another internal address when the Git subprocess connects.
As a result, the migration succeeds even though a direct request to the same internal address is
correctly rejected. |
|---|
| स्रोत | ⚠️ https://codeberg.org/forgejo/forgejo/issues/13433 |
|---|
| उपयोगकर्ता | spooky (UID 96038) |
|---|
| सबमिशन | 15/07/2026 03:28 PM (2 महीनों पहले) |
|---|
| संयम | 29/08/2026 09:04 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397072 [Forgejo तक 15.0.4 Repository Migration is_migrate_allowed.go net.LookupIP अधिकार वृद्धि] |
|---|
| अंक | 19 |
|---|