Summary
Gitea incorrectly attributed deploy-key-authenticated pushes to the repository owner during push hook permission checks. A holder of a writable deploy key could therefore bypass protected-tag allow lists, change repository visibility through push options, and have AGit pull requests attributed to the owner.
Gitea incorrectly attributed deploy-key-authenticated pushes to the repository owner during push hook permission checks. A holder of a writable deploy key could therefore bypass protected-tag allow lists, change repository visibility through push options, and have AGit pull requests attributed to the owner.
Affected context
The issue occurs in Gitea repositories that use writable deploy keys and rely on push hook authorization for protected tags or push-option handling. It is relevant when the hook pipeline resolves the authenticated principal as the repository owner rather than as the deploy key identity.
The issue occurs in Gitea repositories that use writable deploy keys and rely on push hook authorization for protected tags or push-option handling. It is relevant when the hook pipeline resolves the authenticated principal as the repository owner rather than as the deploy key identity.
Exploit preconditions
- Attack surface: Git push handling and related push hook processing
- Required access: A writable deploy key for the target repository
- Trigger point: A push involving protected tags or supported push options, or an AGit pull-request flow
- Why exploitation is possible: Authorization checks use the repository owner identity instead of the deploy key's effective principal
- Attack surface: Git push handling and related push hook processing
- Required access: A writable deploy key for the target repository
- Trigger point: A push involving protected tags or supported push options, or an AGit pull-request flow
- Why exploitation is possible: Authorization checks use the repository owner identity instead of the deploy key's effective principal
Why this happens
The underlying defect is an authorization-context confusion error. Although the request was authenticated with a deploy key, downstream permission checks treated the repository owner as the actor, causing access-control decisions to be evaluated against the wrong identity. This maps to CWE-863: Incorrect Authorization, where a valid request is permitted without correctly enforcing the intended subject's permissions.
The underlying defect is an authorization-context confusion error. Although the request was authenticated with a deploy key, downstream permission checks treated the repository owner as the actor, causing access-control decisions to be evaluated against the wrong identity. This maps to CWE-863: Incorrect Authorization, where a valid request is permitted without correctly enforcing the intended subject's permissions.
Potential impact
- An attacker may create protected tags without being on the configured allow list.
- A private repository could be made public through permitted push-option processing.
- Repository integrity and release-management controls could be weakened.
- Pull requests may be attributed to the wrong identity, complicating auditing and accountability.
- An attacker may create protected tags without being on the configured allow list.
- A private repository could be made public through permitted push-option processing.
- Repository integrity and release-management controls could be weakened.
- Pull requests may be attributed to the wrong identity, complicating auditing and accountability.
General mitigation guidance
Mitigation generally focuses on preserving the authenticated principal throughout the complete authorization pipeline.
Common defensive patterns include:
- Distinguishing deploy keys, users, applications, and repository owners as separate authorization subjects.
- Performing protected-tag and push-option checks against the actual authenticated identity.
- Applying explicit allow lists and deny-by-default rules to sensitive repository operations.
- Restricting deploy-key write access to repositories and workflows that require it.
- Limiting which push options can alter repository state or visibility.
- Recording the effective authentication principal consistently for audit and pull-request attribution.
Mitigation generally focuses on preserving the authenticated principal throughout the complete authorization pipeline.
Common defensive patterns include:
- Distinguishing deploy keys, users, applications, and repository owners as separate authorization subjects.
- Performing protected-tag and push-option checks against the actual authenticated identity.
- Applying explicit allow lists and deny-by-default rules to sensitive repository operations.
- Restricting deploy-key write access to repositories and workflows that require it.
- Limiting which push options can alter repository state or visibility.
- Recording the effective authentication principal consistently for audit and pull-request attribution.
How teams detect issues like this
Organizations can look for authorization-context confusion through:
- Static analysis and code review checks that trace authenticated identities into permission decisions.
- Tests covering deploy keys, protected tags, push options, repository visibility changes, and AGit workflows.
- Audit-log comparisons between the authentication method, recorded pusher, and authorization subject.
- Policy enforcement requiring security-sensitive operations to use explicit principal types and deny-by-default checks.
- Automated review tools that flag authorization decisions based on repository ownership rather than the authenticated actor.
Organizations can look for authorization-context confusion through:
- Static analysis and code review checks that trace authenticated identities into permission decisions.
- Tests covering deploy keys, protected tags, push options, repository visibility changes, and AGit workflows.
- Audit-log comparisons between the authentication method, recorded pusher, and authorization subject.
- Policy enforcement requiring security-sensitive operations to use explicit principal types and deny-by-default checks.
- Automated review tools that flag authorization decisions based on repository ownership rather than the authenticated actor.
Sources
| Source | Link |
|---|---|
| blog. | blog.gitea.com/ |
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
