Gitea Docker Reverse-Proxy Authentication Bypass

This four-file repository is a self-contained, local-lab PoC for CVE-2026-20896, an authentication/authorization bypass attributed to unsafe reverse-proxy trust configuration in official Gitea Docker images through 1.26.2. Dockerfile builds from gitea/gitea:1.26.2, enables reverse-proxy authentication, starts Gitea, creates random-password accounts (administrator gitea-admin and regular user student01), creates a private gitea-admin/private-proof repository, and stores a fixed proof value in proof.txt. poc.py is the primary exploit entry point. It uses only Python standard-library HTTP components and submits the attacker-controlled X-WEBAUTH-USER header. It establishes a control comparison: anonymous and student01 requests should fail, while a request impersonating gitea-admin should receive HTTP 200 and the exact proof marker. No shell, persistence, or command-execution payload is included; the demonstrated impact is unauthorized private-resource access through administrator identity spoofing.

This repository contains a small but functional proof-of-concept exploit for CVE-2026-20896, an authentication bypass affecting Gitea deployments described as vulnerable up to version 1.26.2 when reverse-proxy authentication is enabled and proxy trust is misconfigured. The main exploit file, CVE-2026-20896.py, is a Python script using requests and argparse. It performs a single HTTP GET to a user-supplied target URL while injecting the X-WEBAUTH-USER header with an attacker-chosen username. If the target accepts the forged reverse-proxy authentication header, the script prints the HTTP status code and enumerates cookies returned by the server, effectively helping the operator capture a valid authenticated session for the impersonated user. Repository structure is straightforward: (1) CVE-2026-20896.py is the exploit entry point; (2) Dockerfile builds a reproducible vulnerable lab based on gitea/gitea:1.26.2, enables reverse-proxy authentication, waits for the service to become healthy via /api/healthz, and creates an admin user named jbkira; and (3) README.md documents the vulnerability, exploitation workflow, lab setup, example usage, and mitigation guidance. The Dockerfile is not part of the attack itself but supports local validation and demonstrates the required vulnerable configuration. Exploit capability is limited but actionable: it does not execute code on the target, drop malware, or brute-force credentials. Instead, it abuses trust in a spoofable authentication header to impersonate an existing user and obtain session cookies. This makes it an operational web exploit PoC rather than a mere detector. The attack vector is remote web/network access to a publicly reachable Gitea instance. The main fingerprintable artifacts are the forged X-WEBAUTH-USER header, target URLs on port 3000, and the lab health endpoint /api/healthz. The exploit requires knowledge of a valid username and a target configured to honor reverse-proxy authentication from untrusted sources.

Repository contains a small standalone Python PoC and companion detector for CVE-2026-20896 affecting Gitea reverse-proxy authentication trust handling. Structure is minimal: README with usage and context, detect.py for safe vulnerability checking, poc.py for exploitation, and docker-compose.yml for a reproducible local vulnerable lab using gitea/gitea:1.26.2 on port 3000. The main exploit is poc.py: it sends an HTTP request to the normal web page /user/settings with a spoofed X-WEBAUTH-USER header, relies on the target accepting that header as trusted reverse-proxy identity, captures any issued session cookies, and writes them to browser-importable TXT and JSON files. This enables arbitrary user impersonation and browser session reuse rather than command execution. detect.py is not the exploit itself; it is a checker that compares baseline and spoofed requests to /user/settings and reports likely vulnerability conditions. The docker-compose file intentionally enables reverse-proxy authentication while leaving trusted proxies at the vulnerable default/wildcard behavior described in the comments, making the lab exploitable. Overall, this is a real operational web-session impersonation PoC for Gitea, not just a README or pure detector.

Repository contains a small standalone Python proof-of-concept and a companion detection script for CVE-2026-20896 affecting Gitea official Docker images up to 1.26.2. The vulnerability is not a memory corruption bug but a web authentication trust failure caused by the Docker image default REVERSE_PROXY_TRUSTED_PROXIES = * combined with enabled reverse-proxy authentication. The PoC in poc.py sends normal HTTP requests to a protected page (/user/settings) and repeats the request with a spoofed X-WEBAUTH-USER header. If the target trusts the header from any source IP, Gitea creates or authenticates the named user and returns the protected page, demonstrating arbitrary user impersonation and potential admin takeover. The exploit is operational but simple: no shell payload, just authenticated session hijacking through header spoofing. detect.py is a safer checker that compares baseline and spoofed responses to determine likely vulnerability without intentionally impersonating a real user. docker-compose.yml provides a reproducible vulnerable lab using gitea/gitea:1.26.2 on port 3000 with reverse-proxy authentication and auto-registration enabled, intentionally inheriting the insecure wildcard trusted-proxy default. Overall structure: README with vulnerability explanation and usage, poc.py for exploitation, detect.py for detection, and docker-compose.yml for local reproduction.