Selfhosted

61004 readers

370 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

Remote Code Execution in Forgejo? (dustri.org)

submitted 3 months ago* (last edited 2 months ago) by tofu@lemmy.nocturnal.garden to c/selfhosted@lemmy.world

40 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] Nibodhika@lemmy.world 4 points 2 months ago (1 children)

I don't get how that output showcases anything, unless he had run that against a known instance of forgejo so the owners of that instance could confirm that he actually executed code. But he's only showing a text file, that's like saying look I hacked super_secure_self_hosted_service:

python hack_it.py localhost:3000

Hacked!

For all we know chain_alpha.py is just a bunch of prints.

Also, even if it is real (which I don't really doubt, but I have seen no proof) holding the information instead of properly disclosing it is just childish. It's not a carrot methodology, it's a stick one, and one without a carrot. This is the sort of thing you do to big companies with no morals, doing it to a small open source project is just wrong, they don't have the manpower or money to redo the investigation you already did. Release a CVE, talk to the devs, and/or push a PR, but saying "I found a vulnerability but I won't tell you about it" is just dumb.

[–] aesthelete@lemmy.world 5 points 2 months ago

This is the sort of thing you do to big companies with no morals, doing it to a small open source project is just wrong, they don’t have the manpower or money to redo the investigation you already did.

Given that the dude works for an AI-based security company, and Forgejo and services like it (e.g., codeberg.org) are how you abandon the mess of vibe-coded trash that is GitHub, in my opinion he has a motivation to pick apart this specific service.