CVE-2024-54148

Summary

Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. The vulnerability is fixed in 0.13.1.

Affected Software

Weaknesses

• CWE-61: CWE-61: UNIX Symbolic Link (Symlink) Following
• CWE-22: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: total

References

• https://github.com/gogs/gogs/security/advisories/GHSA-r7j8-5h9c-f6fx
• https://github.com/gogs/gogs/issues/7582
• https://github.com/gogs/gogs/pull/7857
• https://github.com/gogs/gogs/commit/c94baec9ca923f38c19f0c7c5af722b9ec04022a

• ←Previous
• Next→