Dustri

---
In this session we are going to explore the vulnerabilities documented in this carrot disclosure post at https://dustri.org/b/carrot-disclosure-forgejo.html and try to reproduce the script that explores the chain to gain admin access to forgego.

The post mentions just briefly what's been used to create the vuln chain: `SSRF in a lot of places, no CSP/Trusted-Types, a bit of ghetto templating in javascript, cryptographic malpractices, overlooks in the authentication mechanisms (OAuth2, OTP, sessions/access handling, post-compromission recovery, …), a bunch of low-hanging DoS, information leak all over the place, various TOCTOU, … All in all, it took me one evening after work to find a good amount of vulnerabilities (adding to the one I got from looking at gitea at some point in the past), and chain some of them to obtain a full-blown RCE`.

There is also the outline of the script call and the output we will use to base the script reproduction:

```
$ python3 ./chain_alpha.py --target http://127.0.0.1:3000 > out.txt
$ grep Backdoor out.txt
[+] Backdoor admin created: svc_ljeopgid / dukecepapsygiqks!A1
$ tail -n17 out.txt

================================================================
[+] COMMAND EXECUTION CONFIRMED!
================================================================

Server-side hook output (received via git push stderr):

remote: ==========================================
remote: FORGEJO RCE PoC - Command Execution Proof
remote:…

> Internationalisation is hard, like for Пётр Ильич Чайковский (Tchaikovsky) and his 31 different names on MusicBrainz.

https://dustri.org/b/horrible-edge-cases-to-consider-when-dealing-with-music.html

Also from Wikipedia:

Pyotr Ilyich Tchaikovsky (note: Often anglicized as Peter Ilich Tchaikovsky; also standardized by the Library of Congress. His names are also transliterated as Piotr or Petr; Ilitsch or Il'ich; and Tschaikowski, Tschaikowsky, Chajkovskij, or Chaikovsky. He used to sign his name/was known as P. Tschaïkowsky/Pierre Tschaïkowsky in French (as in his afore-reproduced signature), and Peter Tschaikowsky in German, spellings also displayed on several of his scores' title pages in their first printed editions alongside or in place of his native name. The modern transliterations of Russian produce the following results for 'Пётр Ильич Чайковский' — ISO 9: Pëtr Ilʹič Čajkovskij, ALA-LC: Pëtr Ilʹich Chaĭkovskiĭ, BGN/PCGN: Pëtr Il'ich Chaykovskiy.)

https://en.wikipedia.org/wiki/Pyotr_Ilyich_Tchaikovsky

"Every other browser vendor is a for-profit entity, ..."

Not the one that authored the text-only browser I am typing this from.

Whether Mozilla turns a profit or not makes little difference in this instance. Mozilla does not survive on donations from users. Its employees are not volunteers working for free to defend user privacy. Its generously compensated executives and staff need money from the online ad business, just like employees from the other browser vendors. If Mozilla stopped taking money from Google or some other online ad business partner, then Mozilla employees would lose their jobs.

Maybe of interest: https://dustri.org/b/mozilla-is-still-screwing-around-with-privacy-in-firefox.html

This feature (or the decisions behind it) does harm non-users. Firefox devs have publicly claimed that it will replace Firefox's current reading list. Before Pocket integration, the integration of Reading List into Firefox Sync was planned, which is a end-to-end encrypted service with very strict ToS -- much stricter than Pocket's current ones: http://dustri.org/b/firefox-youre-supposed-to-be-in-my-pocket-not-the-other-way-around.html

Claiming that no money was involved makes the situation much worse -- it implies your core values have changed.

At Webconverger I've been working on whittling these leaking issues down, by wiresharking Firefox, e.g.

https://github.com/Webconverger/webconverger-addon/issues/42
https://github.com/Webconverger/webconverger-addon/issues/41
https://github.com/Webconverger/webconverger-addon/issues/43

Though with things like https://bugzilla.mozilla.org/show_bug.cgi?id=1100304 and anti-features like http://dustri.org/b/firefox-youre-supposed-to-be-in-my-pocket-not-the-other-way-around.html you got to wonder if Mozilla has stopped caring about privacy.

I know gitea / forgejo will be a popular suggestion, either self-hosted or via something like Codeberg. Despite also being a GitHub user since 2010 and also "doomscrolling" issues for projects I am involved in, I do host a gitea for personal projects where I don't need the GitHub network effect. It works well and is surprisingly capable!

Having said that, I stumbled upon this curious blog post about a security issues in Forgejo: https://dustri.org/b/carrot-disclosure-forgejo.html