Anuragbathani

A blind Server-Side Request Forgery (SSRF) exists when the `[oauth2 client] UPDATE AVATAR = true` setting is enabled. The issue occurs because the server fetches the avatar URL provided by an OAuth2/OIDC provider—typically the `picture` claim—using the default Go HTTP client without applying outbound host or IP restrictions. A low-privileged user who can influence their own `picture` claim can force the Gitea server to make arbitrary outbound HTTP GET requests to loopback addresses, RFC 1918 private network addresses, and IPv4 link-local addresses such as `169.254.169.254`. Technical details include: - **Vulnerable Function**: `oauth2UpdateAvatarIfNeed()` in `routers/web/auth/oauth.go` and `oauth2SignInSync()` in `routers/web/auth/oauth signin sync.go`. - **Vulnerable Variable**: `gothUser.AvatarURL`. While the issue is primarily blind because non-image responses are rejected, the impact increases if the server can reach cloud metadata services or internal services that return valid image data, which could then be stored as the user's avatar.

Gotenberg fails to properly validate metadata tags passed to ExifTool, a tool used for reading and writing image, audio, and video metadata. While the software blocks specific tags like `FileName` and `Directory` to prevent unauthorized file manipulation, it does not account for group prefixes. An attacker can use `System:FileName` or `System:Directory` to bypass these checks because the system only performs an exact match against the blocked names. Additionally, the `FilePermissions` tag is entirely missing from the blocklist. This allows remote attackers to move, rename, and change permissions for arbitrary files within the container via a single HTTP request without authentication. This issue affects every endpoint that accepts the `metadata` field, including: - '/forms/chromium/convert/html' - '/forms/libreoffice/convert' - '/forms/pdfengines/merge' - '/forms/pdfengines/metadata/write' Vulnerable parameters include `System:FileName`, `System:Directory`, and `FilePermissions` within the `metadata` field.