A security researcher has uncovered a critical-severity vulnerability in Gogs, a commonly used open-source alternative to GitHub Enterprise or GitLab.
The critical argument injection vulnerability has not yet been assigned a CVE ID. However, it could allow an authenticated user to achieve remote code execution – without any interaction with other users or requiring admin privileges.
“Since Gogs ships with open registration enabled by default (DISABLE_REGISTRATION = false) and no limit on repository creation (MAX_CREATION_LIMIT = -1), an unauthenticated attacker can simply create an account and repository on any default-configured instance,” Jonah Burgess, senior security researcher at Rapid7, said in a 28 May blog post.
“Any registered user who creates a repo is automatically its owner. From there, enabling rebase merging is a single toggle in settings, and the entire exploit chain can be operated without interaction from any other user.”
Similarly, a user with write access to a repository that has rebase enabled can engage in direct exploitation.
Regardless, the end result is a compromised server and read access to every repo on the instance. This could, in turn, lead to a credential dump, the compromise of additional systems, and the ability to modify any code hosted in the repository.
The exploit can be automated and run in seconds.
“The latest release versions at the time of research, Gogs 0.14.2 and 0.15.0+dev (commit b53d3162), were confirmed to be affected,” Burgess said.
“All prior versions supporting the ‘Rebase before merging’ style are likely vulnerable as well.”
In addition, the vulnerability impacts all supported platforms and installation methods. At the time of writing, a Shodan search revealed more than 1,100 vulnerable internet-facing instances of the service. Gogs is often left exposed in this manner to facilitate remote collaboration.
The vulnerability was discovered on 16 March and reported to Gogs maintainers a day later. The maintainers acknowledged the report on 28 March, but, according to Rapid7, have not responded to further contact attempts, despite being warned of the disclosure date of 28 May.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
David Hollingworth
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.