Gogs Zero-Day Exposes Servers to Remote Code Execution
A critical zero-day vulnerability has been discovered in the open-source self-hosted Git service, Gogs, allowing for remote code execution (RCE) on affected servers. The flaw, identified by Rapid7, stems from an argument injection issue within the ‘Rebase before merging’ operation, potentially exposing sensitive data and granting attackers control over the server. This vulnerability highlights the importance of careful configuration and regular security updates for self-hosted Git services.
The vulnerability, assigned a CVSS score of 9.4, arises from the way Gogs handles pull requests and the ‘Rebase before merging’ operation. Attackers can exploit this by crafting malicious branch names that inject the –exec flag into the git rebase function, leading to command execution with the privileges of the Gogs server process user. The issue is exacerbated by Gogs’ default open registration and unlimited repository creation, allowing unauthenticated attackers to easily create accounts and repositories. The potential impact is significant, including arbitrary command execution, access to all repositories, credential theft, and the ability to modify hosted code. Rapid7 has provided a Metasploit module and IoCs to assist in detection and remediation.