Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1wZnZoLXA4cXAtOXd3Oc4AAx3Y

Gogs OS Command Injection vulnerability

Impact

The malicious user is able to update a crafted config file into repository's .git directory in combination with crafted file deletion to gain SSH access to the server on case-insensitive file systems. All installations with repository upload enabled (default) on case-insensitive file systems (Windows, macOS, etc.) are affected.

Patches

Make sanitization of upload path to .git directory to be case-insensitive. Users should upgrade to 0.12.11 or the latest 0.13.0+dev.

Workarounds

Disable repository upload.

References

https://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97/

For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7030.

Permalink: https://github.com/advisories/GHSA-pfvh-p8qp-9ww9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wZnZoLXA4cXAtOXd3Oc4AAx3Y
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 1 year ago
Updated: over 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-pfvh-p8qp-9ww9, CVE-2022-2024
References:

• https://github.com/gogs/gogs/security/advisories/GHSA-pfvh-p8qp-9ww9
• https://nvd.nist.gov/vuln/detail/CVE-2022-2024
• https://github.com/gogs/gogs/issues/7030
• https://github.com/gogs/gogs/commit/15d0d6a94be0098a8227b6b95bdf2daed105ec41
• https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129
• https://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97
• https://github.com/advisories/GHSA-pfvh-p8qp-9ww9

Repository: https://github.com/gogs/gogs
Blast Radius: 0.0

Affected Packages