Summary

An unauthenticated remote attacker can submit Org-mode markup containing
a #+INCLUDE directive to POST /{owner}/{repo}/markup for any suitable public
repository to read arbitrary server files. By extracting INTERNAL_TOKEN from
app.ini, they can inject a Git hook through the internal logger and achieve
command execution as the Gitea OS user during an anonymous clone.

Details

Gitea registers POST /{username}/{reponame}/markup with optional sign-in,
repository assignment, and a repository-unit reader check. An anonymous user
passes that check for a public repository with a normal readable code unit.
The handler passes the supplied Mode, Text, and FilePath into Gitea's
generic markup renderer. Selecting Mode: file and a .org filename chooses
the Org-mode renderer.

Gitea 1.27.0 initializes go-org using org.New() and does not replace its
default ReadFile callback. In go-org 1.9.1, that callback is ioutil.ReadFile;
#+INCLUDE accepts absolute paths and passes them directly to that callback.

Preconditions

• At least one repository is publicly readable and exposes a unit accepted by
  the repository markup route. A normal public repository with its code unit
  enabled satisfies this condition.
• Standard Gitea storage permissions allow the service user to update Gitea's
  managed global Git configuration.

Impact

• Read arbitrary files accessible to the Gitea service user without an account.
• Submit the file-read payload directly through a public repository's web markup
  route without committing a file or obtaining repository write access.
• Expose Gitea configuration, internal bearer tokens, OAuth/JWT material, and deployment metadata

Affected

• The vulnerable version seem v1.22.1 ~ v1.27.0

Credit

Found by @xbow-security. Triaged by Guido Leo guido.leo@xbow.com.

Independently reported by https://github.com/NightRang3r