Listen to this Post
The vulnerability exists within the `PutContents` API endpoint used for writing files to a repository. This endpoint fails to properly validate and handle symbolic links (symlinks) within the target directory structure. An attacker with commit privileges can craft a malicious payload containing a symlink. When the `PutContents` function processes this request, it will blindly follow the symlink’s pointer. This allows the attacker to write arbitrary file content to a location outside the intended repository tree, dictated by where the symlink points. By strategically pointing the symlink to a critical location, such as the `.git/hooks` directory, the attacker can plant a executable hook script. The next time a standard Git operation (like a git pull) triggers the hook, the attacker’s code will be executed with the privileges of the Gogs service account, leading to local code execution on the server.
Platform: Gogs
Version: <= 0.13.0
Vulnerability: Symlink Arbitrary Write
Severity: High
date: 2024-12-10
Prediction: Patch 2024-12-20
What Undercode Say:
Check installed version: `gogs –version`
Craft symlink: `ln -s /target/path linkname`
Verify hook: `ls -la .git/hooks/`
How Exploit:
Attacker commits symlink.
Symlink points to `.git/hooks/post-merge`.
PutContents writes payload to hook.
Git operation triggers execution.
Achieves server-side RCE.
Protection from this CVE
Apply vendor patch.
Disable server hooks.
Validate file paths.
Use security sandboxes.
Impact:
Remote Code Execution.
Repository Compromise.
System Takeover.
Privilege Escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
