GHSA-wv27-2vqp-j7g5

Summary

The Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function.

Details

Here is the function implementation of the secure New Migration functionality. [image: image]

Here is the function implementation of the Mirror Settings without any validation. [image: image]

PoC

The New Migration feature correctly blocked my attempt to import a local repository. [image: image]

But if I create a normal migration with a valid repository. [image: image]

Then, I could use the Mirror Settings feature under the Repository Settings sync a local repository. [image: image]

Here is the result after the sync. [image: image]

Impact

Users can import local repositories from the server's filesystem, which allows accessing any repository the git user has access to. There is also a potential issue of blind SSRF.