Gogs PR Pre-merge Rebase Remote Code Execution (RCE) Vulnerability Analysis and PoC

Gogs: Remote Code Execution (RCE) in PR Merges via Argument Injection Vulnerability Overview Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by injecting the flag into the command through a crafted branch name during the Pull Request merge process. Impact Scope Affected Versions: Gogs 0.14.2 (latest supported version), Gogs 0.15.0+dev (main branch since 2023-03-16), and all previous versions supporting the "Rebase before merging" merge style. Severity: Critical - CVSS 3.1 Base Score: 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Impact: - Server Compromise: Arbitrary command execution as the user running the Gogs process. - Cross-Tenant Data Leak: Read all repositories on the instance, including private repositories of other users. - Credential Theft: Access the database containing password hashes, API tokens, SSH keys, and 2FA secrets. - Lateral Movement: Access other systems from the server's network. - Supply Chain Attacks: Modify the code of hosted repositories. Mitigation Primary Fix: Add a separator to the command. Defensive Measure: Validate branch names and reject those starting with . Additional Hardening: Apply the separator to all other calls. Proof of Concept (PoC) Code `` http://localhost:3000 http://localhost:3000/attacker/demo/settings UPDATE repository SET enable_pulls=1, pull_allow_rebase=1 WHERE lower_name='demo'; TestPullRequests` goroutine must set the PR to Mergeable. Wait a few seconds, then refresh the PR page.

Goal Reached Thanks to every supporter — we hit 100%!

Gogs PR Pre-merge Rebase Remote Code Execution (RCE) Vulnerability Analysis and PoC

More from this source