PT-2022-13488 · Gogs · Gogs

Published 2022-03-11 · Updated 2024-08-21 · CVE-2022-0870

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions gogs versions prior to 0.12.5

Description The issue is related to Server-Side Request Forgery (SSRF) in the repository migration functionality of gogs. This allows a malicious user to discover services in the internal network. All installations that accept public traffic are affected. The internal network CIDRs are prohibited from being used as repository migration targets.

Recommendations For versions prior to 0.12.5, upgrade to 0.12.5 or the latest 0.13.0+dev to resolve the issue. As a temporary workaround, consider running gogs in its own private network until an update can be applied. Restrict access to the repository migration functionality to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-0870

GHSA-7V5R-R995-Q2X2

GO-2022-0566

Affected Products

Gogs

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0870.json · Exploit
• 🔥 https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531 · Exploit
• https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0870 · Security Note
• https://osv.dev/vulnerability/GO-2022-0566 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0870 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7v5r-r995-q2x2 · Vendor Advisory
• https://github.com/gogs/gogs · Note
• https://t.me/cvenotify/28096 · Telegram Post
• https://github.com/advisories/GHSA-7v5r-r995-q2x2 · Note
• https://t.me/cibsecurity/38779 · Telegram Post
• https://t.me/cvenotify/28099 · Telegram Post