Vulnerability advisory

GHSA-m27m-h5gj-wwmg

Gogs allows argument Injection when tagging new releases

Published Dec 23, 2024Updated Dec 23, 2024OSV record ↗

Also known as CVE-2024-39933GHSA-8mm6-wmpp-mmm3GO-2024-2972

Severity

CVSS 3.xCVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:C/UI:N

Affected versions

gogs.io/gogs Go

All gogs.io/gogs advisories →

Affected	Fixed in
All versions before 0.13.1	`0.13.1`

Description

Impact

Unprivileged user accounts with at least one SSH key can read arbitrary files on the system. For instance, they could leak the configuration files that could contain database credentials ([database] *) and [security] SECRET_KEY. Attackers could also exfiltrate TLS certificates, other users' repositories, and the Gogs database when the SQLite driver is enabled.

Patches

Unintended Git options has been ignored for creating tags (https://github.com/gogs/gogs/pull/7872). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.

Workarounds

No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.

References

https://www.cve.org/CVERecord?id=CVE-2024-39933