Introduction
Getting your homelab hacked is a nightmare for any tech enthusiast. Yet, it’s an experience that can happen to anyone, even the most prepared. Recently, my Forgejo instance was compromised via an RCE (Remote Code Execution) vulnerability, and I'm here to share what I learned from this mishap.
The Discovery
It all began on a Saturday morning with a series of Komodo notifications, my monitoring tool. My server, usually stable with a CPU usage at 4%, was suddenly spiking to 95% and dropping back to 80%. The culprit? My Forgejo Docker container.
Logging in as an admin, I discovered a new user, "testpoc26188", and a suspicious repo with a shell script titled "post-index-change". This was my first mistake: not disabling open sign-ups.
The Vulnerability
Analyzing the script led me to CVE-2026-60004, a recently disclosed vulnerability in Gitea, on which Forgejo is based. This flaw allows an attacker to execute a malicious Git hook to gain RCE.
My next mistake? Not updating my container from Forgejo version 13, which had reached its end of life six months prior. I relied on versioned tags instead of a non-existent "latest" tag from Forgejo.
The Exploit
Using the POC published by Gitea, I compared the exploit used against my server. The malicious command line connected to a remote server and executed commands remotely on my system.
Corrective Measures
To prevent this from happening again, I took several steps:
- Regular Updates: I automated updates for my containers, with pre-tests on a staging environment.
- Security Hardening: Disabled open sign-ups and strengthened firewall rules.
- Increased Monitoring: Improved alerts to detect abnormal behaviors faster.
Conclusion
This experience was a powerful reminder of the importance of continuous vigilance and system updates. Security is an iterative process, and I’ve learned valuable lessons from this incident.
Let's discuss your project in 15 minutes.