Roquefort_CVE-2019-11229

CVE-2019-11229

---

The target Gitea instance is vulnerable to CVE-2019-11229 due to its outdated version; 1.7.5

A vulnerability has been found in Gitea up to 1.7.5/1.8-RC2 and classified as critical. Affected by this vulnerability is an unknown code block of the file models/repo_mirror.go. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Exploit

---

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/roquefort]
└─$ searchsploit -m multiple/webapps/49383.py ; mv 49383.py CVE-2019-11229.py
  Exploit: Gitea 1.7.5 - Remote Code Execution
      URL: https://www.exploit-db.com/exploits/49383
     Path: /usr/share/exploitdb/exploits/multiple/webapps/49383.py
    Codes: CVE-2019-11229
 Verified: True
File Type: Python script, ASCII text executable
Copied to: /home/kali/PEN-200/PG_PRACTICE/roquefort/49383.py

Exploit locally available

Modifications

---

Modifications have been made to the exploit script to include the payload as well as to fit the current engagement context.