{"uuid": "cff22e84-9b17-4e78-9683-a05476adb4f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14144", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitea_git_hooks_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Podalirius\", \"Christophe De La Fuente\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module leverages an insecure setting to get remote code\\n          execution on the target OS in the context of the user running Gitea.\\n          This is possible when the current user is allowed to create `git\\n          hooks`, which is the default for administrative users. For\\n          non-administrative users, the permission needs to be specifically\\n          granted by an administrator.\\n\\n          To achieve code execution, the module authenticates to the Gitea web\\n          interface, creates a temporary repository, sets a `post-receive` git\\n          hook with the payload and creates a dummy file in the repository.\\n          This last action will trigger the git hook and execute the payload.\\n          Everything is done through the web interface.\\n\\n          It has been mitigated in version 1.13.0 by setting the Gitea\\n          `DISABLE_GIT_HOOKS` configuration setting to `true` by default. This\\n          disables this feature and prevents all users (including admin) from\\n          creating custom git hooks.\\n\\n          This module has been tested successfully against docker versions 1.12.5,\\n          1.12.6 and 1.13.6 with `DISABLE_GIT_HOOKS` set to `false`, and on\\n          version 1.12.6 on Windows.\", \"disclosure_date\": \"2020-10-07\", \"fullname\": \"exploit/multi/http/gitea_git_hooks_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Gitea Git Hooks Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/gitea_git_hooks_rce.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/gitea_git_hooks_rce\", \"references\": [\"CVE-2020-14144\", \"EDB-49571\", \"URL-https://podalirius.net/articles/exploiting-cve-2020-14144-gitea-authenticated-remote-code-execution/\", \"URL-http://web.archive.org/web/20211209025818/https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1126-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/\"], \"rport\": 3000, \"session_types\": false, \"targets\": [\"Unix Command\", \"Linux Dropper\", \"Windows Command\", \"Windows Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:48.518066Z"}