Vulnerability advisory
GHSA-pfvh-p8qp-9ww9
Gogs OS Command Injection vulnerability
Also known as CVE-2022-2024GO-2023-1596
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected versions
| Affected | Fixed in |
|---|---|
| All versions before 0.12.11 | 0.12.11 |
Description
Impact
The malicious user is able to update a crafted config file into repository's .git directory in combination with crafted file deletion to gain SSH access to the server on case-insensitive file systems. All installations with repository upload enabled (default) on case-insensitive file systems (Windows, macOS, etc.) are affected.
Patches
Make sanitization of upload path to .git directory to be case-insensitive. Users should upgrade to 0.12.11 or the latest 0.13.0+dev.
Workarounds
Disable repository upload.
References
https://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97/
For more information
If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7030.
References
- Webgithub.com/gogs/gogs/security/advisories/GHSA-pfvh-p8qp-9ww9 ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2022-2024 ↗
- Webgithub.com/gogs/gogs/issues/7030 ↗
- Webgithub.com/gogs/gogs/commit/15d0d6a94be0098a8227b6b95bdf2daed105ec41 ↗
- Packagegithub.com/gogs/gogs ↗
- Webgithub.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129 ↗
- Webhuntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97 ↗