CVE-2021-28378: 
NixOS vulnerability analysis and mitigation

Gitea versions 1.12.x and 1.13.x before 1.13.4 were affected by a Cross-Site Scripting (XSS) vulnerability that allowed attackers to inject malicious code via certain issue data. The vulnerability was discovered in March 2021 and tracked as CVE-2021-28378. The issue affected the issue popup functionality in Gitea, where user-controlled content was not properly escaped before being rendered in the interface (NVD, CVE).

The vulnerability stemmed from missing string escaping on the client-side for content fetched from the server. Specifically, the issue was in the web_src/js/features/contextpopup.js file where label names, issue titles, and body content were not properly HTML-escaped before being inserted into popup content. The vulnerability received a CVSS v3.1 Base Score of 5.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability could allow attackers to execute arbitrary JavaScript code in the context of other users' browsers when they hover over specially crafted issue references. This could lead to theft of CSRF tokens, which could be used to perform authenticated actions on behalf of the victim, potentially including administrative actions if the victim had sufficient privileges (PandatiX).

The vulnerability was exploitable by creating an issue or pull request with specially crafted content, including malicious code in the title, body, or labels. When other users hover over references to these issues, the malicious code would execute in their browser context. The attack required the attacker to have permissions to create issues or pull requests in at least one repository (PandatiX).

The vulnerability was fixed in Gitea version 1.13.4 by implementing proper HTML escaping for user-controlled content in issue popups. The fix was implemented through commit 1e3c3388fb82235d9f3d63a0bad62ca3ff4682ab, which added HTML escaping for label names, issue titles, and body content (Gitea PR).