Headline
CVE-2022-0905: Improper Authorization in gitea
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4.
Description
When Gitea is build and configured for PAM authentification it skips checking authorization completely. Therefore expired accounts and accounts with expired passwords can still login.
Proof of Concept
You can expire an account with chage -E0 <username> and still login.
Impact
Since disabling an account in PAM still allows to login via ssh-keys, it’s common to set accounts to expire if you want to deny access. So accounts who technically don’t have any privilege are still allowed to login. To circumvent this, after an successful call to pam_authenticateit is necessary to call pam_acct_mgmt.