gitea-public-repo-exposure: Gitea Public Repository - Exposure

id: gitea-public-repo-exposure

info:
  name: Gitea Public Repository - Exposure
  author: theamanrawat
  severity: low
  description: |
    Detected publicly accessible Gitea instances exposing repository listings and user information without authentication.
  reference:
    - https://gitea.io/
    - https://docs.gitea.io/en-us/
  metadata:
    shodan-query: http.title:"Gitea"
    fofa-query: title="Gitea"
  tags: gitea,exposure,misconfig,git

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/explore/repos"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(to_lower(body), "explore repositories", "gitea")'
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/api/v1/repos/search?q=&limit=50"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"data\":", "\"clone_url\":", "\"full_name\":")'
        condition: and
# digest: 4a0a00473045022100a4f5b56dba14ed1c30bd05e1e12a9139646447ea424286e6552cf4234ba5d0b402202ed46f25c8020a04a83b9c10603f2534f5db4ea9a334c48ec005841593329905:922c64590222798bb761d5b6d8e72950