Gogs Zero-Day Allows Server Remote Code Execution
TL;DR. A critical zero-day vulnerability in the open source Git service Gogs enables remote code execution on affected servers. - The flaw stems from an argument injection issue exploitable by authenticated attackers using malicious branch names in pull requests. - Rapid7 disclosed the critical vulnerability, assigned a CVSS score of 9.4, affecting the self-hosted Git platform. - Attackers can exploit this without user interaction by leveraging default open registration settings on Gogs instances.
- A zero-day vulnerability in Gogs allows authenticated attackers to perform remote code execution.
- The flaw (CVSS 9.4) is an argument injection issue during the 'Rebase before merging' operation.
- Attackers exploit it by injecting the --exec flag into git rebase via malicious branch names.
- Gogs' default open registration and no repository limit make exploitation easier for unauthenticated users.
Sources
- Gogs Zero-Day Exposes Servers to Remote Code Execution — securityweek.com