CVE-2022-1884: Remote Command Execution in gogs/gogs
Impact
The malicious user is able to upload a crafted config file into repository's .git directory with to gain SSH access to the server. All Windows installations with repository upload enabled (default) are affected.
Patches
Repository file uploads are prohibited to its .git directory. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.
Workarounds
Disable repository files upload.
References
https://www.huntr.dev/bounties/9cd4e7b7-0979-4e5e-9a1c-388b58dea76b/
For more information
If you have any questions or comments about this advisory, please post on #6968.
Other sources
A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the treepath parameter during file uploads. An attacker can set treepath=.git. to upload a file into the .git directory, allowing them to write or rewrite the .git/config file. If the core.sshCommand is set, this can lead to remote command execution.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1884?
CVE-2022-1884 is considered a high severity vulnerability that allows malicious users to upload a crafted config file for unauthorized SSH access.
How do I fix CVE-2022-1884?
To fix CVE-2022-1884, update your Gogs installation to version 0.12.8 or later.
Which versions of Gogs are affected by CVE-2022-1884?
CVE-2022-1884 affects Gogs versions prior to 0.12.8, specifically versions 0.12.7 and earlier.
Is Windows the only platform affected by CVE-2022-1884?
No, while the issue has been noted on Windows installations, it is primarily related to Gogs regardless of platform.
What is the impact of CVE-2022-1884?
The impact of CVE-2022-1884 is that an attacker can gain unauthorized SSH access to the server through a maliciously crafted config file.