abraxas/gitea-stargazers-hiddenProof-of-concept and lab for an unauthenticated Gitea information disclosure: the stargazers and watchers API leaks usernames that profile endpoints hide.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · gitea-stargazers-hidden
Gitea 1.27.3 - Gitea
Limited and private users are supposed to vanish from anonymous viewers. GetInfo already 404s them. Follower lists already apply isUserVisibleToViewerCond in SQL. GetStargazers is a join on star with no visibility filter. ListStargazers then convert.ToUsers the lot. ListSubscribers is the same shape for watchers.
Without logging in, a public repo's stargazers JSON names users that GET /users/{name} hides.
| ID | no CVE yet |
| CWE | CWE-200 |
| CVSS | Medium: 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| Product | Gitea |
| Affected | through v1.27.3 (146cc3e) |
| Auth | unauthenticated |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
Without logging in, read a public repo's stargazers and watchers and learn usernames that GET /users/{name} hides. That is recon on limited and private accounts that starred or watched something public: people who set visibility so they would not show up in search, then clicked star anyway.
It is a username, not an email, not a private-git read, not RCE. Combined with the Follow 204 vs 404 oracle, you can confirm a hidden login exists even when the profile 404s.
Visibility was a theme of the 1.27.3 GHSA wave. When a product 404s a profile on purpose, the next question is which list endpoints still join user without that condition. Stars and watchers do.
I planted hidstar as limited, starred and watched a public repo, and hit the instance with no token. Unauth GET /api/v1/users/hidstar is 404. Unauth stargazers JSON includes hidstar. Unauth watchers include hidstar. Unauth followers HTML does not. The profile is shy. The star table is not.
Wrong turns already recorded: unauth GET /users/hidstar returning 200 (then visibility is off entirely - lab requires 404); followers HTML listing hidstar (that path already applies the condition); treating a 200 on /stargazers with only public names as SUCCESS; a reverse shell. Theatre. The leak is the limited login in the JSON.
cd lab
./run.sh
Target only http://127.0.0.1:18133. Compose allows public,limited,private visibility and leaves stars on.
unauth-user-get status=404
unauth-stargazers status=200 stargazer-names=['hidstar']
unauth-watchers leak=True
unauth-followers-web limited-in-html=False
SUCCESS GITEA-STARGAZERS-HIDDEN
Apply isUserVisibleToViewerCond in GetStargazers / GetRepoWatchers. Unauth stargazers and watchers must omit hidstar the same way followers already do.
star.go router · star.go model · subscriber.go · GetInfo · GetUserFollowersGNU Affero GPL v3.0. See LICENSE. Loopback lab only. No warranty.