Gogs CVE-2024-44625: Symbolic Link Path Traversal Leading to RCE

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Type: Remote Code Execution (RCE). - Vulnerability ID: CVE-2024-44625. - Affected Version: Gogs latest version (0.13.0). - Impact: Default-installed accounts can exploit this vulnerability to access and edit repository files. 2. Exploitation Method: - Exploitation Technique: Symbolic Link Path Traversal. - Exploitation Process: - Users modify and rename repository files via Gogs’ web editor. - The frontend sends a POST request to the endpoint . - The request is handled by the function, which validates and sanitizes request parameters. - calls the function, which performs direct filesystem operations and commits changes. 3. Vulnerability Impact: - File Modification: Users can modify and rename repository files. 表 File Execution: By modifying file contents, arbitrary code can be executed. 4. Mitigation Measures: - Disable public and untrusted user access. - Disable user registration. - Set strong passwords. - Enable 2FA (Two-Factor Authentication). - Migrate to Gitea, an actively maintained fork of Gogs that is not affected by this vulnerability. 5. Code Example: - Provides Gogs code snippets demonstrating how to execute arbitrary code by modifying file contents. 6. Vulnerability Report: - The author reported the vulnerability in Gogs’ file and submitted a vulnerability report on GitHub. - The author made multiple attempts to contact the Gogs development team but received no response. 7. Recommendations: - Users running Gogs are advised to implement the above mitigation measures. - Users are recommended to migrate to Gitea, an actively maintained fork of Gogs that is unaffected by this vulnerability. This information provides a detailed overview of the RCE vulnerability in Gogs, including exploitation methods, impact scope, and mitigation strategies.

Goal Reached Thanks to every supporter — we hit 100%!

Gogs CVE-2024-44625: Symbolic Link Path Traversal Leading to RCE