GHSA-9cpj-qc93-vw8v Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer
SummaryMe again.Gitea's built-in 3D file viewer (powered by Online3DViewer) is vulnerable to stored cross-site scripting (XSS) through crafted `.gltf` files. When a glTF file declares an unsupported required extension, Online3DViewer generates an error message containing the extension name and Gitea inserts it into the DOM using `innerHTML` without sanitization. An attacker who can push a `.gltf` file to any repository can execute arbitrary JavaScript in the context of any user who views the file.Affected VersionsGitea **1.25.0** and later (3D file preview was introduced in 1.25 via the Online3DViewer integration)Confirmed on `gitea:1.25-nightly` (SHA `e33d1da...`), which bundles `online-3d-viewer` npm package v0.16.0The upstream [Online3DViewer](https://github.com/kovacsv/Online3DViewer) library is the root causeSeverityStored XSS: the payload persists in the repository and fires on every page viewExecutes under the Gitea origin with the victim's session (cookies, CSRF tokens)Any authenticated user viewing the file is compromisedEnables full account takeover (token creation, settings modification, repository manipulation)No user interaction beyond viewing the file page is requiredDetailsRoot CauseWhen Online3DViewer parses a glTF file, it checks whether all `extensionsRequired` entries are supported. For unsupported extensions, it calls:The `SetError` method stores this message, and Gitea's rendering code inserts it into the page using `innerHTML`:The extension names from `extensionsRequired` are taken directly from the JSON file with no escaping or sanitization, allowing HTML injection.Attack VectorAn attacker creates a `.gltf` file with a malicious `extensionsRequired` value:The attacker pushes this file to any Gitea repository they have write access to (including forks of public repositories).When any user navigates to the file's page in the Gitea web UI, the 3D viewer attempts to render it, encounters the "unsupported extension," and inserts the error message (containing the attacker's HTML) into the DOM via `innerHTML`.The injected `<img onerror>` handler executes arbitrary JavaScript under the Gitea origin with the victim's authenticated session.ImpactFrom the XSS context, an attacker can:**Create API access tokens** for the victim by POSTing to `/user/settings/applications` with the page's CSRF token**Read private repositories** via same-origin API calls**Modify repository contents** (supply chain attacks)**Escalate to admin** if the victim is a Gitea administrator**Exfiltrate data** via `fetch`, `XMLHttpRequest`, or `navigator.sendBeacon`Proof of ConceptMinimal PoC (alert box)Save as `poc.gltf` and push to any Gitea 1.25+ repository:Navigate to the file in the Gitea web UI. The alert will fire.Suggested FixesSanitize or text-encode the error message before DOM insertion. Replace `innerHTML` with `textContent` for error display:Alternatively, escape HTML entities in the error message before insertion.Additional hardeningRender 3D file previews inside a sandboxed `<iframe>` with `sandbox="allow-scripts"` and a restrictive CSP (`default-src 'none'`), similar to how Gitea already handles SVG attachmentsApply Content-Security-Policy headers to file preview pages that restrict inline script execution
CVSS v3.1 score: 8.7