Description

A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/is_migrate_allowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named b313bb83f5ff22bcc0378e0e0ca7bbd58303f168. It is recommended to apply a patch to fix this issue. The project maintainer explains: "I don't intend to backport this to v15 or v16 as it is a breaking change."

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-30T18:17:00.563Z",
  "pubdate": "2026-08-30T18:17:00.563Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in Forgejo up to version 15.0.4 within the Repository Migration Handler.\nThe vulnerability originates in the services/migrations/allowlist/is_migrate_allowed.go file, specifically involving the net.LookupIP function.\nRemote attackers can exploit this flaw to perform unauthorized requests from the server's network context, potentially bypassing internal network security controls and accessing sensitive internal resources.\nThe risk is elevated due to the public availability of exploit information.\nThe vulnerability allows an attacker to manipulate migration parameters to force the server to initiate arbitrary connections to unintended targets.\nNo authentication is explicitly required to trigger the remote attack vector, making it highly accessible for exploitation.\nMaintainers have released a patch (b313bb83f5ff22bcc0378e0e0ca7bbd58303f168) but have stated they do not intend to backport this fix to v15 or v16 due to breaking changes, requiring users to upgrade to versions that incorporate the security fix.",
  "technicalDetails": "The vulnerability resides within the repository migration logic of Forgejo, specifically in the file services/migrations/allowlist/is_migrate_allowed.go. The flaw is triggered when the application utilizes net.LookupIP to validate migration sources or destination addresses during the repository import/migration process.\nThe root cause is an insufficient validation of user-supplied input before passing it to the net.LookupIP function. Because the input handling fails to adequately restrict the scope of the resolution to verified or intended network addresses, an attacker can supply malicious hostnames or IP addresses that resolve to internal infrastructure unreachable by external clients.\nAttack flow: 1) The attacker initiates a repository migration request through the Forgejo interface or API. 2) The attacker specifies a target URI designed to trigger the vulnerable lookup logic. 3) The server processes the request and calls net.LookupIP on the attacker-controlled input. 4) The library resolves the address, potentially bypassing allowlist checks that are intended to restrict migrations to legitimate external services. 5) The server-side request is then dispatched to the resolved address. 6) The server effectively acts as a proxy for the attacker, enabling interaction with internal services such as metadata services (e.g., cloud environment IMDS), internal databases, or administrative interfaces protected by perimeter firewalls.\nThe impact includes the potential for information disclosure, unauthorized interaction with internal APIs, and the discovery of internal network topologies. By leveraging the server's identity and network positioning, an attacker can bypass traditional access control lists that rely on IP-based authentication, as the requests originate from the trusted Forgejo application server.\nThe vulnerability affects Forgejo versions up to 15.0.4. Successful exploitation does not inherently require high-level privileges, as the migration endpoint is often accessible to users capable of initiating repository imports. The presence of public exploit material significantly lowers the barrier to entry for potential attackers. Since the patch b313bb83f5ff22bcc0378e0e0ca7bbd58303f168 introduces breaking changes, organizations must carefully manage their migration to a patched version, as the maintainers have explicitly declined backporting the fix to v15 and v16 branches."
}