CVE-2020-14144: 
NixOS vulnerability analysis and mitigation

The git hook feature in Gitea versions 1.1.0 through 1.12.5 allows authenticated remote code execution in environments where users have permission to create Git hooks. The vendor has indicated this is not a vulnerability and states it is a functionality of the software that is limited to a very limited subset of accounts (AttackerKB, NVD).

If a Gitea user is allowed to create Git hooks, which is the default for administrators, code execution on the server through the web interface is possible. This privilege can also be granted to a non-administrative user. Git hooks are scripts that are executed before or after an event such as push, commit, etc. Allowing a user to create such scripts is potentially dangerous and should be avoided as much as possible (AttackerKB).

The vulnerability allows an authenticated attacker with Git hook permissions to execute arbitrary code on the server with the privileges of the user running Gitea. This could lead to complete system compromise if proper isolation is not in place (AttackerKB).

A Metasploit exploit module exists that leverages this insecure setting. The module creates a new repository, sets a post-receive Git hook containing malicious code, and adds a dummy file to trigger code execution (Rapid7 Blog).

The issue has been mitigated in version 1.13.0 by setting the Gitea DISABLE_GIT_HOOKS configuration to true by default. This completely disables the Git hook creation feature and prevents all users (including admin) from creating custom Git hooks. Administrators will need to think twice before changing it back to false, since it is a serious security risk (AttackerKB).