Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1jY3F2LTQzdm0tNGYzd84ABCrb

Gogs allows deletion of internal files

Impact

Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. It allows attackers to access and alter any users' code hosted on the same instance.

Patches

Deletion of .git files has been prohibited (https://github.com/gogs/gogs/pull/7870). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.

Workarounds

No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.

References

https://www.cve.org/CVERecord?id=CVE-2024-39931

Permalink: https://github.com/advisories/GHSA-ccqv-43vm-4f3w
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jY3F2LTQzdm0tNGYzd84ABCrb
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: 29 days ago
Updated: 29 days ago

CVSS Score: 10.0
CVSS vector: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N

EPSS Percentage: 0.00043
EPSS Percentile: 0.10511

Identifiers: GHSA-ccqv-43vm-4f3w, CVE-2024-39931
References:

• https://github.com/gogs/gogs/security/advisories/GHSA-ccqv-43vm-4f3w
• https://nvd.nist.gov/vuln/detail/CVE-2024-39931
• https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1
• https://github.com/advisories/GHSA-ccqv-43vm-4f3w

Repository: https://github.com/gogs/gogs
Blast Radius: 0.0

Affected Packages