CVE-2022-0870 PoC — Gogs 代码问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0870.yaml

Associated Vulnerability

Title:Gogs 代码问题漏洞 (CVE-2022-0870)
Description:Gogs（Go Git Service）是GOGS团队的一个基于Go语言的自助Git托管服务，它支持创建、迁移公开/私有仓库，添加、删除仓库协作者等。 Gogs 0.12.5之前版本中存在安全漏洞，该漏洞源于应用中缺少对于服务器跨站请求伪造的token验证。

Description

Gogs GitHub repository before 0.12.5 is susceptible to server-side request forgery. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

File Snapshot


 id: CVE-2022-0870

info:
  name: Gogs <0.12.5 - Server-Side Request Forgery
  author: theamanrawat,A

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!