My Gitea instance was hacked. What do I do now?

General
1

I’m running Gitea 1.24.6 on my Ubuntu server, and until recently everything worked fine. Suddenly, my SSH keys stopped working and I was being prompted for a password to fetch my remote (Gitea) repos. When I use a password, it says the repo doesn’t exist.

I am in the web interface and I can see my repos do still exist, and that the commits appear to be there, but I can’t access them using git.

I didn’t realize what was going on until I went into /admin/users/ and saw that I now have over 5,000 users, with email domains like gitea.local, exploit.local, db.invalid, attacker.com, and so on.

I just went into the .ini and set ENABLE_REGISTRATION to ‘false’. Clearly I had not configured this properly when I set it up. What do I do now? I need to get rid of all these thousands of users, and I need to be able to access my repos again.

1 Like
2

To be fair, it’s maybe an overstatement to say it was hacked. It just has tons of registered, fake users. But this has coincided with the repos becoming unavailable so these things must be related.

1 Like
3

Alright, well this is how I fixed this problem. I SSHed into my server and ran this:

for i in {15..5512}; do sudo -u git gitea admin user delete --id $i --purge -c /etc/gitea/app.ini; done

What’s happening in this command?

  • It’s looping through all the user IDs from #15 to #5512 (The first 14 users are real);
  • It’s running Gitea CLI as the ‘git’ user;
  • It’s deleting every user in the loop, along with any repo they set up and anything in it (purge);
  • It’s looking in app.ini for the Gitea config.

This removed all the bogus users. After this, my repos just started working again. I don’t know why, but this fixed it.