Gitea Remote Code Execution via diffpatch Git Hook Injection

#!/usr/bin/env bash
# check_cve_2026_60004.sh — Detect CVE-2026-60004 (Gitea diffpatch RCE)
# Usage: bash check_cve_2026_60004.sh <GITEA_BASE_URL>
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <GITEA_BASE_URL>"
  echo "Example: $0 https://gitea.example.com:3000"
  exit 2
fi

BASE_URL="${1%/}"
API_URL="${BASE_URL}/api/v1/version"

# Fetch version from Gitea API
RESPONSE=$(curl -sf --max-time 10 "${API_URL}" 2>/dev/null) || {
  echo "UNKNOWN — could not reach ${API_URL}"
  exit 2
}

VERSION=$(echo "${RESPONSE}" | grep -oP '"version"\s*:\s*"\K[^"]+' 2>/dev/null) || {
  echo "UNKNOWN — could not parse version from response"
  exit 2
}

echo "Detected Gitea version: ${VERSION}"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$(echo "${VERSION}" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')"

if [ -z "${MAJOR:-}" ] || [ -z "${MINOR:-}" ] || [ -z "${PATCH:-}" ]; then
  echo "UNKNOWN — could not parse semantic version from '${VERSION}'"
  exit 2
fi

# Vulnerable: 1.17.0 <= version <= 1.27.0
# Fixed: >= 1.27.1
if [ "${MAJOR}" -eq 1 ]; then
  if [ "${MINOR}" -ge 17 ] && [ "${MINOR}" -le 26 ]; then
    echo "VULNERABLE — Gitea ${VERSION} is in the affected range (1.17.0–1.27.0). CVE-2026-60004 applies."
    exit 1
  elif [ "${MINOR}" -eq 27 ] && [ "${PATCH}" -eq 0 ]; then
    echo "VULNERABLE — Gitea ${VERSION} is in the affected range (1.17.0–1.27.0). CVE-2026-60004 applies."
    exit 1
  elif [ "${MINOR}" -eq 27 ] && [ "${PATCH}" -ge 1 ]; then
    echo "PATCHED — Gitea ${VERSION} contains the fix for CVE-2026-60004."
    exit 0
  elif [ "${MINOR}" -ge 28 ]; then
    echo "PATCHED — Gitea ${VERSION} is beyond the affected range."
    exit 0
  elif [ "${MINOR}" -lt 17 ]; then
    echo "PATCHED — Gitea ${VERSION} predates the affected range (1.17.0+). Not vulnerable to CVE-2026-60004."
    exit 0
  fi
elif [ "${MAJOR}" -gt 1 ]; then
  echo "PATCHED — Gitea ${VERSION} is beyond the affected major version."
  exit 0
fi

echo "UNKNOWN — could not determine vulnerability status for version ${VERSION}"
exit 2