Published Corrective releases of the collaborative development platform Forgejo 16.0.4 and 15.0.8 have been issued to address a critical vulnerability (CVE not assigned) that could allow a remote attacker to execute code on the server. Administrators of Forgejo servers are urged to promptly update their systems and check for any signs of compromise. The vulnerability was caused by a failure to properly clean when creating a new repository from a template.
To avoid the injection of malicious commands when processing a user-supplied template, Forgejo removes the .git/ subdirectory from it before initializing a new git repository on the server. However, an attacker could circumvent this by manipulating variable substitution into files within the .forgejo/template directory, allowing them to create a .git/ subdirectory along with its contents (e.g. by substituting “../../.git/hooks” into the file path). This could lead to the inclusion of arbitrary processes upon initializing the git repository. The issue was resolved by deleting the .git/ subdirectory just before executing “git init” instead of before expanding the variables.
A similar vulnerability was addressed in Gitea 1.25.5 back in February, proving the importance of promptly fixing such security flaws in collaborative development platforms.