PT-2022-14171 · Gogs · Gogs

Published 2022-06-02 · Updated 2024-11-25 · CVE-2022-1884

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions gogs/gogs versions <=0.12.7

Description A remote command execution issue exists due to improper validation of the tree path parameter during file uploads. An attacker can upload a file into the .git directory by setting tree path=.git., allowing them to write or rewrite the .git/config file. If the core.sshCommand is set, this can lead to remote command execution. The issue affects all Windows installations with repository upload enabled.

Recommendations For gogs/gogs versions <=0.12.7, upgrade to version 0.12.8 or later to resolve the issue. As a temporary workaround, consider disabling repository file uploads to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2022-1884

GHSA-958J-443G-7MM7

GO-2022-0749

Affected Products

Gogs

References · 15

• 🔥 https://huntr.com/bounties/9cd4e7b7-0979-4e5e-9a1c-388b58dea76b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-1884 · Security Note
• https://osv.dev/vulnerability/GO-2022-0749 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1884 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-958j-443g-7mm7 · Vendor Advisory
• https://github.com/gogs/gogs · Note
• https://github.com/gogs/gogs/security/advisories/GHSA-958j-443g-7mm7 · Note
• https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129 · Note
• https://github.com/gogs/gogs/issues/6968 · Note
• https://github.com/gogs/gogs/pull/6970 · Note
• https://github.com/gogs/gogs/releases/tag/v0.12.8 · Note
• https://huntr.dev/bounties/9cd4e7b7-0979-4e5e-9a1c-388b58dea76b · Note
• https://twitter.com/Hossted_OSS/status/1860931268524839198 · Twitter Post
• https://t.me/cvedetector/11065 · Telegram Post
• https://twitter.com/CVEnew/status/1857381725997027560 · Twitter Post