Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.
SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues.
Summary
The Gogs API still accepts tokens in URL parameters such as token and accesstoken, which can leak through logs, browser history, and referrers.
Details
A static review shows that the API still checks tokens in the URL query before looking at headers:
- internal/context/auth.go reads c.Query("token") - internal/context/auth.go falls back to c.Query("accesstoken") - internal/context/auth.go only checks the Authorization header when the query token is empty - internal/context/auth.go authenticates using that token and marks the request as token-authenticated
Token-authenticated requests are accepted by API routes through c.IsTokenAuth checks: - internal/route/api/v1/api.go
Impact
If tokens are sent in URLs such as /api/v1/user?token=..., they can leak in logs, browser or shell history, and referrer headers, and can be reused until revoked.
Recommended Fix
- Authentication headers should be used exclusively for token transmission. - Token parameters should be blocked at the proxy or WAF level. - Query strings should be scrubbed from logs. - A strict referrer policy should be set.
Remediation
A fix is available at https://github.com/gogs/gogs/releases/tag/v0.14.2.
Vulnerability Description
The endpoint PUT /repos/:owner/:repo/contents/ does not require write permissions and allows access with read permission only via repoAssignment().
After passing the permission check, PutContents() invokes UpdateRepoFile(), which results in:
Commit creation Execution of git push
As a result, a token with read-only permission can be used to modify repository contents.
---
Attack Prerequisites
Possession of a valid access token Read permission on the target repository (public repository or collaborator with read access)
---
Attack Scenario
1. The attacker accesses the target repository with a read-only token 2. The attacker sends a PUT /contents request to update an arbitrary file 3. The server creates a commit and performs a git push on behalf of the attacker
---
Potential Impact
Source code tampering Injection of backdoors Compromise of release artifacts and distributed packages
Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown.