CVE-2022-30781
HIGHGitea < 1.16.7 - Remote Code Execution via Git Fetch Remote
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2022-30781.
PoCs published by samguy, wuhan005, wuhan005, li4n0, krastanoel, including Metasploit module exploits/multi/http/gitea_git_fetch_rce.
AI-analyzed exploit summary This Metasploit module exploits CVE-2022-30781, a remote code execution vulnerability in Gitea's repository migration process via crafted Git fetch commands. It authenticates, creates a repository, and triggers migration to execute arbitrary commands.
Description
Gitea before 1.16.7 does not escape git fetch remote.
Exploits (3)
This Metasploit module exploits CVE-2022-30781, a remote code execution vulnerability in Gitea's repository migration process via crafted Git fetch commands. It authenticates, creates a repository, and triggers migration to execute arbitrary commands.
This repository contains a proof-of-concept exploit for CVE-2022-30781, a remote command execution vulnerability in Gitea's repository migration feature. The exploit involves hosting malicious files and tricking a Gitea instance into executing arbitrary commands during migration.
This Metasploit module exploits a remote code execution vulnerability in Gitea's repository migration process via Git fetch command injection. It supports multiple targets including Unix, Linux, and Windows systems.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N