Top
Best
New

Posted by weierstass 18 hours ago

Forgejo <=16.0.3 Critical RCE(codeberg.org)
186 points | 68 commentspage 2
miguelgrinberg 15 hours ago|
For those on version 15 LTS, this fix was released with v15.0.8.
snvzz 9 hours ago|
Updated mine now. The release notes[0].

0. https://codeberg.org/forgejo/forgejo/src/branch/forgejo/rele...

innocent_name 16 hours ago||
The opex and security fine costs of moving off managed services like GitHub/GitLab are catching up.
lukeify 12 hours ago||
The amount of time I need to spend maintaining my Forgejo instance this year, even after accounting for this RCE, has been less than the amount of time GitHub has been degraded or unavailable this year.
lloydatkinson 8 minutes ago||
That doesn't match my experience at all. I had a Foregjo instance on a Raspberry Pi, and maybe it's typical SD card issues, but the number of times that Forgejo has crashed because it locked its own database and couldn't continue and the number of times repos I mirror from GitHub just mysteriously stop syncing is quite probably the same number of times GitHub has been down this year.
kstrauser 14 hours ago|||
This vulnerability, which doesn’t affect my installation, would take approximately 5 minutes to patch if it did. With that exception, my server will have had approximately 99.999% uptime over the last several years.

It would take a boatload of such events to equal the opex of GitHub hosting. That’s not an excuse to run amok, but it’s far from tipping the scales in GitHub’s cost favor.

cyberpunk 12 hours ago||
Yep. I have one hanging off an openbsd machine on a tailnet, took me like... 5 minutes to update it, and it's not exactly a common setup...
davidee 11 hours ago||
Wouldn't most users considering or using Forgejo also have considered (or used) self-hosted Gitlab which would have the same opex / security costs (and much higher hardware requirements)?
PaoloBarbolini 17 hours ago||
If you are self-hosting Forgejo and haven't done it yet, consider creating a Codeberg account and following https://codeberg.org/forgejo/security-announcements/issues
xyst 16 hours ago|
Updates also posted to #forgejo-chat:matrix.org channel.
p4bl0 15 hours ago||
They also have a releases RSS feed. I have those in my mail client (Thunderbird) directly for the projects that I must closely follow critical updates of.
bitbasher 11 hours ago||
This is why I prefer simpler setups for personal use/hosting. Something like cgit that has no accounts has much less surface area for this kind of issue.
nightpool 16 hours ago||
What does the error message mean by "Your search request"? Why is viewing a single file in a repository considered a search request? That smells like poor caching somewhere
Sphax 17 hours ago||
Can't load the page but hopefully it's on an endpoint sitting behind my Tinyauth protection.
teaearlgraycold 10 hours ago||
Glad I have my Forgejo service set to auto update.
dboreham 16 hours ago||
Quick note that this is not an RCE in the typical sense that I can rock up to a Forgejo installation and execute code on the server. The attack vector here is via a template repo specified when initializing a new repo. The template repo could contain malicious code that then executes on the host server. So if you don't create new repos from mystery meat template repos, you should be ok.
nightpool 16 hours ago||
Are you sure? The change says "A malicious template repository could be used to read arbitrary data from the Forgejo host" (emphasis added). Couldn't an attacker create a template repo and then immediately create a new repo from their own template, causing the Forgejo process to execute their template code on the server?
msm_ 15 hours ago||
They could, and this is definitely a RCE (a Remote Code Execution) vulnerability. GP confusion stems from the fact, that you (the forgejo user) must execute this attack on "your" instance. But of course the problem is that forgejo user can, in fact, be malicious, and use this vulnerability to escalate their priviliges from user to server.

It can't be done without authenticating first, but there's nothing about RCE that says that it must be sent from unauthenticated connection.

mitxela 6 hours ago||
Would be good to label it "authenticated RCE" to make this clear
msm_ 15 hours ago||
>So if you don't create new repos from mystery meat template repos, you should be ok.

You should be OK, but if attacker takes over your user (or any user in your forgejo instance) they can execute code on the host server - as you said yourself. In other words, it allows them to achieve remote code execution, so it's a RCE.

bakugo 16 hours ago|
Trying to open any codeberg.org page from my main Helium browser results in a 403 just saying "Bye". Opening in Chrome or Firefox works fine. Very confusing.
More comments...