XSS in Gitea Issue Data (1.12.x, 1.13.x < 1.13.4)

This repository provides a full exploit chain for CVE-2021-28378, a client-side XSS vulnerability in Gitea (versions 1.12.0 to <1.13.4) that allows attackers to escalate privileges and achieve remote code execution. The repository contains: - A detailed README.md explaining the vulnerability, affected versions, and exploitation context. - exploit.py: A Python script that automates the attack. It logs into a target Gitea instance, creates a malicious repository and issue containing a JavaScript payload, and then posts a link to this issue in a victim's repository. Once the victim interacts with the crafted issue, the payload executes in their browser, escalating the attacker's privileges to admin. The script then sets up a malicious git hook to trigger a reverse shell to the attacker's machine. - exploit1.js, exploit2.js, exploit3.js: JavaScript payloads for use in XSS attacks. These scripts perform actions such as creating issues with stolen data, deleting repositories, and directly escalating a user to admin by sending crafted POST requests to the Gitea admin API. The exploit chain leverages both browser-based (XSS) and network-based vectors, targeting the Gitea web application and its API endpoints. The main endpoints involved are the Gitea web interface (http://mygitea.com or http://localhost:3000), the API for repository and user management, and the attacker's own IP for the reverse shell. The exploit is operational, providing a working privilege escalation and remote code execution path, and is not just a proof of concept.