{"vulnerability": "cve-2020-14144", "sightings": [{"uuid": "93261eaf-8397-42a6-8b60-3550733e66d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14144", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "8190ece9-e723-4c62-b919-9fa65981f7d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14144", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:24.000000Z"}, {"uuid": "46bae5fe-b08f-457a-8bad-2947e88960f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14144", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitea_git_hooks_rce.rb", "content": "", "creation_timestamp": "2021-04-07T18:51:53.000000Z"}, {"uuid": "90b20455-f22f-4805-b06e-7fe1c8c70c31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2020-14144", "type": "seen", "source": "https://gist.github.com/Mavment/c4a8adde129bc111799be2976e559e63", "content": "", "creation_timestamp": "2026-01-25T10:53:43.000000Z"}, {"uuid": "7f2f792f-9e68-4394-8720-89624ac860c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14144", "type": "seen", "source": "https://t.me/arpsyndicate/4751", "content": "#ExploitObserverAlert\n\nCVE-2020-14144\n\nDESCRIPTION: Exploit Observer has 27 entries in 9 file formats related to CVE-2020-14144. The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states \"This is a functionality of the software that is limited to a very limited subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides.\n\nFIRST-EPSS: 0.972340000\nNVD-IS: 5.9\nNVD-ES: 1.2\nARPS-PRIORITY: 0.915973", "creation_timestamp": "2024-04-23T17:52:29.000000Z"}, {"uuid": "cff22e84-9b17-4e78-9683-a05476adb4f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14144", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitea_git_hooks_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Podalirius\", \"Christophe De La Fuente\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module leverages an insecure setting to get remote code\\n          execution on the target OS in the context of the user running Gitea.\\n          This is possible when the current user is allowed to create `git\\n          hooks`, which is the default for administrative users. For\\n          non-administrative users, the permission needs to be specifically\\n          granted by an administrator.\\n\\n          To achieve code execution, the module authenticates to the Gitea web\\n          interface, creates a temporary repository, sets a `post-receive` git\\n          hook with the payload and creates a dummy file in the repository.\\n          This last action will trigger the git hook and execute the payload.\\n          Everything is done through the web interface.\\n\\n          It has been mitigated in version 1.13.0 by setting the Gitea\\n          `DISABLE_GIT_HOOKS` configuration setting to `true` by default. This\\n          disables this feature and prevents all users (including admin) from\\n          creating custom git hooks.\\n\\n          This module has been tested successfully against docker versions 1.12.5,\\n          1.12.6 and 1.13.6 with `DISABLE_GIT_HOOKS` set to `false`, and on\\n          version 1.12.6 on Windows.\", \"disclosure_date\": \"2020-10-07\", \"fullname\": \"exploit/multi/http/gitea_git_hooks_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Gitea Git Hooks Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/gitea_git_hooks_rce.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/gitea_git_hooks_rce\", \"references\": [\"CVE-2020-14144\", \"EDB-49571\", \"URL-https://podalirius.net/articles/exploiting-cve-2020-14144-gitea-authenticated-remote-code-execution/\", \"URL-http://web.archive.org/web/20211209025818/https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1126-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/\"], \"rport\": 3000, \"session_types\": false, \"targets\": [\"Unix Command\", \"Linux Dropper\", \"Windows Command\", \"Windows Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:48.518066Z"}]}