Hackers are actively exploiting a severe vulnerability in the official Docker image for Gitea, a popular self-hosted Git service. The flaw enables remote attackers to completely bypass authentication, impersonate any user—including administrators—and take full control of affected instances.
BleepingComputer first reported the issue, noting the critical flaw carries a maximum severity score of 10.0. Its exploitation grants attackers a direct path to compromise an organization's source code repositories, development workflows, and potentially its entire continuous integration and continuous deployment (CI/CD) pipeline.
The vulnerability does not exist within the core Gitea codebase. Instead, it stems from a misconfiguration in the way certain versions of the official Docker image handle a security environment variable during startup. Specifically, the interaction with the GITEA__security__INSTALL_LOCK setting, which is routinely enabled post-installation to secure a deployment, inadvertently creates an authentication bypass under specific conditions.
The practical impact is significant. An attacker with network access to a vulnerable instance can craft a special request to circumvent login procedures entirely. This allows them to impersonate any user on the system without needing a password. The simplicity of the attack method has led to active scanning and exploitation in the wild, making unpatched Docker deployments immediate targets.
For development teams and operations staff, a breach of this nature is severe. It provides attackers with read and write access to all stored code, commits, and pull requests. From this vantage point, they could steal proprietary intellectual property, introduce malicious code into a codebase, or leverage integrated CI/CD tools to attack build servers and internal networks.
The incident highlights a growing concern around supply chain security in modern DevOps practices. Pre-built container images, while offering convenience and standardization, become critical dependencies that must be managed with rigorous lifecycle controls. This event demonstrates that the security of a software system can be compromised by the configuration of its packaging and deployment artifacts, not just its core code.
The Gitea project has released a patched Docker image to resolve the issue. Teams are urged to update their container deployments immediately. Administrators should also audit their configurations to ensure the INSTALL_LOCK variable and other security hardening measures are correctly implemented as a temporary mitigation.
This vulnerability serves as a stark reminder for Hong Kong's tech professionals, as for developers everywhere, that the tools forming the backbone of the software development process are not immune to compromise. It underscores the need for comprehensive security practices that extend from source code scanning to the management of the underlying infrastructure and images upon which modern applications are built.
駭客正積極利用官方Docker映像中一個嚴重漏洞，針對熱門的自託管Git服務Gitea。該漏洞允許遠端攻擊者完全繞過認證，冒充任何使用者——包括管理員——並完全控制受影響的實例。
BleepingComputer首先報導了此事，指出此關鍵漏洞的嚴重性評分為最高的10.0分。利用此漏洞可讓攻擊者直接入侵組織的原始碼儲存庫、開發工作流程，並可能影響其整個持續整合與持續交付（CI/CD）流程。
此漏洞並不存在於Gitea的核心代碼庫中。相反，它源於特定版本官方Docker映像在啟動時處理安全環境變數的方式存在設定錯誤。具體而言，與GITEA__security__INSTALL_LOCK設定的互動（該設定通常在安裝後啟用以保障部署安全）在特定條件下無意間造成了認證繞過。
實際影響相當重大。攻擊者若能透過網絡存取有漏洞的實例，即可製作特殊請求以完全繞過登入程序。這使他們無需密碼即可冒充系統上的任何使用者。攻擊方法的簡單性導致其在野外被積極掃描與利用，使未經修補的Docker部署成為首要目標。
對開發團隊和系統管理員而言，此類安全漏洞極為嚴重。它為攻擊者提供了對所有儲存代碼、提交記錄和Pull Request的讀取與寫入權限。由此，他們可能竊取專有知識產權、在代碼庫中植入惡意代碼，或利用整合的CI/CD工具攻擊建置伺服器和內部網絡。
此事件凸顯了現代DevOps實踐中日益增長的供應鏈安全疑慮。預先建置的容器映像雖然提供了便利性和標準化，卻也成為必須透過嚴格生命週期控制來管理的關鍵依賴項。此事件表明，軟件系統的安全性可能因軟件包和部署載體的配置而受損，而不僅僅是其核心代碼。
Gitea項目已發布修補後的Docker映像以解決此問題。團隊被敦促立即更新其容器部署。系統管理員亦應審查其配置，確保INSTALL_LOCK變數和其他安全強化措施作為臨時緩解措施已正確實施。
此漏洞為香港的科技專業人士以及全球開發者敲響了警鐘：構成軟件開發流程支柱的工具並非免疫於被入侵。它強調了從原始碼掃描到現代應用程式所依賴的基礎架構和映像管理，全面實施安全實踐的必要性。