Gitea Remember-Me Token Theft Not Invalidating Attacker Session
The vulnerability is in the Remember-Me (gitea_incredible) token validation logic, specifically when handling a compromised token (hash mismatch).
The vulnerable function is this one:
POST /user/login (and any endpoint triggering autoSignIn via the Remember-Me cookie).
Gitea implements Remember-Me cookies using a split token design (ID:Hash), citing the Paragonie secure remember-me guide. When a token is used, its Hash is rotated, but the ID remains the same.
If an attacker steals a user's Remember-Me token and uses it to authenticate, the attacker is issued a new rotated token (same ID, new Hash). When the legitimate user later attempts to use their original token, Gitea correctly detects a hash mismatch for the given ID.
According to the referenced Paragonie specification, this indicates a compromised token, and ALL active remember-me sessions for that user MUST be invalidated. However, Gitea's CheckAuthToken function simply returns ErrAuthTokenInvalidHash. The calling code (autoSignIn) catches this error and deletes the victim's local cookie via ctx.DeleteSiteCookie, but fails to delete the compromised token from the database.
As a result, the attacker's active session is never invalidated, and the attacker maintains persistent, indefinite access to the victim's account, entirely defeating the purpose of the split-token security design.
왜 이 VPI인가 (설명가능 · 실험적)
VPI 산정 기준
| 영향도(기본값(정보 없음)) | 55.00 |
| 악용 신호(추가 악용신호 없음) | ×1.00 |
| VPI | 55.00 |
VPI 공식 vpi-v1 기준