Description

Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-13T17:17:28.757Z",
  "pubdate": "2026-08-13T17:17:28.757Z",
  "executiveSummary": "Gitea is susceptible to Server-Side Request Forgery (SSRF) vulnerabilities within its migration and mirroring subsystems. These flaws stem from a combination of DNS rebinding vulnerabilities and a failure to re-validate destination URLs during the request lifecycle. The combination of these weaknesses allows malicious actors to bypass initial security checks and force the server to initiate arbitrary outbound HTTP requests to internal, non-routable, or sensitive local network resources that should normally be inaccessible. Successful exploitation can lead to unauthorized access to internal services, metadata endpoints, and local infrastructure connected to the hosting environment. The attacker capabilities include leveraging repository migration or mirroring features to probe internal networks, exfiltrate sensitive data, or interact with backend services operating behind a firewall. Exploitation requirements typically involve the ability to initiate a repository migration or mirror creation action within the Gitea instance, potentially requiring low-privileged user authentication depending on the platform configuration. The risk implications are severe, as internal network perimeters can be compromised via the trusted execution context of the Gitea server.",
  "technicalDetails": "The root cause of the vulnerabilities lies in insufficient validation and sanitization of user-supplied URLs processed by the Gitea migration and mirror modules. Specifically, the implementation suffers from a time-of-check to time-of-use (TOCTOU) flaw compounded by DNS rebinding vulnerabilities. When a user initiates a repository migration or sets up a mirror, Gitea resolves the provided hostname to an IP address during an initial validation phase to ensure the target does not point to internal or private IP ranges. However, because the target URL is not re-validated or re-resolved immediately prior to executing the actual HTTP request, an attacker can manipulate DNS responses through time-to-live (TTL) exhaustion or malicious DNS server control. In an attack flow, the adversary configures a malicious domain that resolves to a safe, publicly routable IP address during the initial validation check performed by Gitea. Once this check successfully passes, the DNS record changes—or rebinds—to point to an internal resource, such as 127.0.0.1, a local loopback address, cloud metadata services (e.g., 169.254.169.254), or other private network segments (e.g., 10.0.0.0/8, 192.168.0.0/16). When Gitea proceeds to fetch the migration data, the underlying HTTP client resolves or re-resolves the domain to the malicious internal IP address, bypassing the initial security controls. The vulnerable components are the migration and mirroring request handlers within the Gitea application logic that fail to enforce strict destination IP whitelisting or pinning throughout the entire request lifecycle. Exploitation requires network exposure of the Gitea migration interface and typically necessitates user authentication to access the repository import features. The payload behavior involves directing the server to interact with internal services, potentially retrieving sensitive configuration data, internal APIs, or cloud instance metadata. The post-exploitation impact includes unauthorized data exposure, internal reconnaissance, and potential remote code execution on adjacent internal systems if vulnerable internal management interfaces are exposed to the SSRF vector."
}