Vulnerability advisory

GHSA-9pp6-wq8c-3w2c

Gogs allows argument injection during the previewing of changes

Published Dec 23, 2024Updated Dec 23, 2024OSV record ↗

Also known as CVE-2024-39932GHSA-hf29-9hfh-w63jGO-2024-2971

Severity

CVSS 3.xCVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N

Affected versions

gogs.io/gogs Go

All gogs.io/gogs advisories →

Affected	Fixed in
All versions before 0.13.1	`0.13.1`

Description

Impact

Unprivileged user accounts can write to arbitrary files on the filesystem. We could demonstrate its exploitation to force a re-installation of the instance, granting administrator rights. It allows accessing and altering any user's code hosted on the same instance.

Patches

Unintended Git options has been ignored for diff preview (https://github.com/gogs/gogs/pull/7871). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.

Workarounds

No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.

References

https://www.cve.org/CVERecord?id=CVE-2024-39932