Gitea Public Registration Enabled

ID: gitea-public-signup

Severity: high

Author: edoardottt

Tags: misconfig,gitea

Description

A misconfiguration in Gitea allows arbitrary users to sign up and read code hosted on the service.

YAML Source

id: gitea-public-signup

info:
  name: Gitea Public Registration Enabled
  author: edoardottt
  severity: high
  description: |
    A misconfiguration in Gitea allows arbitrary users to sign up and read code hosted on the service.
  reference:
    - https://www.youtube.com/watch?v=oHhofSj9lEM&t=157s
    - https://gitea.io/en-us/
  classification:
    cpe: cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: gitea
    product: gitea
    shodan-query: html:"Powered by Gitea"
  tags: misconfig,gitea

http:
  - method: GET
    path:
      - '{{BaseURL}}/user/sign_up'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Powered by Gitea'
          - 'Register -'
        condition: and

      - type: word
        part: body
        words:
          - "Registration is disabled. Please contact your site administrator."
        negative: true

      - type: status
        status:
          - 200
# digest: 4b0a0048304602210085675d409f14cf7cd259c139adeac1d96784dac9eb9a9e463db2e92aacf132e10221008048b88a0329a679564b89a5dbc37ba1a1b32dfc1e036b8eaa0166dfa43b1132:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/misconfiguration/gitea-public-signup.yaml"

View on Github