Gogs Remote Command Execution Vulnerability

A remote command execution vulnerability exists in Gogs versions through 0.13.3. This issue arises from an inadequate fix for a previous vulnerability, allowing files in the .git directory to be modified via the repository contents API. The vulnerability can be exploited by updating the .git/config file, which triggers the execution of arbitrary commands on the server.

Impact

Exploitation of this vulnerability allows for remote command execution on the server where Gogs is hosted.

Reproduction

To reproduce this vulnerability, first create a symbolic link to the .git/config file and push it to a repository. Then, use the API router to update the linked file with a payload that includes a command to be executed. This can be done by sending a PUT request to the repository contents API with the appropriate authorization token and the crafted content that includes the command.

Remediation

Users can upgrade to Gogs versions 0.13.4 or 0.14.0+dev to address this vulnerability.