GHSA-q347-cg56-pcq4 GO-2022-0377
SSRF in repository migration
- Severity
- 5.0 / 10
- Medium · CVSS 3.0
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-918 Server-Side Request Forgery (SSRF)
- Fix
0.12.5- Upgrade gogs.io/gogs to this version or later
Description
Impact
The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected.
Patches
Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.
Workarounds
Run Gogs in its own private network.
References
https://www.huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531/
For more information
If you have any questions or comments about this advisory, please post on #6754.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| gogs.io/gogs | < 0.12.5 |
0.12.5 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
gogs.io/gogs Go → 0.12.5
- go
go get gogs.io/gogs@v0.12.5 && go mod tidy
Severity breakdown
CVSS 3.0 5.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-mq8m-42gh-wq7r Gogs vulnerable to a bypass of CVE-2024-55947 | High Known exploited | Also affects gogs.io/gogs |
| GHSA-3w28-36p9-w929 Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS | Medium | Also affects gogs.io/gogs |
| GHSA-744x-3838-5r56 Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API | Medium | Also affects gogs.io/gogs |
| GHSA-xp79-5mx3-jx52 Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) | Medium | Also affects gogs.io/gogs |
| GHSA-c39w-43gm-34h5 Gogs has Path Traversal in organization name that results in RCE through Git hooks | Critical | Also affects gogs.io/gogs |
| GHSA-6p9m-q3jp-47h4 Gogs: LFS dedupe path leaks private repo content across tenants | High | Also affects gogs.io/gogs |
| GHSA-89mr-xqfv-758m Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym | Critical | Also affects gogs.io/gogs |
| GHSA-wmfg-5p4h-5fw3 Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion | High | Also affects gogs.io/gogs |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor