Hackers Exploit Gitea Docker Image Auth Bypass Vulnerability

Hackers are actively exploiting a critical authentication bypass vulnerability within the official Docker image for Gitea, a popular self-hosted Git service. This flaw, identified as CVE-2024-27974, enables attackers to impersonate any user on a vulnerable instance, including administrators, without requiring any prior authentication. The vulnerability stems from improper handling of user authentication tokens, allowing unauthorized access to sensitive repository data and administrative functions.

Security researchers first disclosed the vulnerability on February 27, 2024, and Gitea released a patch on March 1, 2024, in version 1.21.5. However, many instances running older versions of the Docker image remain exposed. The exploit is particularly concerning because it targets the Docker image, which is a common deployment method for Gitea, making a wide range of installations susceptible. Attackers can leverage this vulnerability to gain full control over repositories, inject malicious code, or disrupt service operations.

Users are strongly advised to update their Gitea installations to version 1.21.5 or later immediately. For those unable to update, Gitea has provided mitigation steps, including disabling the registration of new users and ensuring that the `DISABLE_REGISTRATION` environment variable is set to `true` in their Docker configurations. This temporary measure can help prevent new unauthorized accounts from being created, but it does not fix the underlying authentication bypass. The ongoing exploitation highlights the importance of timely security patching and diligent monitoring of deployed applications, especially those accessible from the internet.