New Gogs zero-day flaw lets hackers get remote code execution
A zero-day vulnerability (CVE-2024-39933) has been identified in Gogs, a self-hosted Git service, allowing authenticated attackers to execute remote code execution (RCE). The flaw, initially discovered by Jonah Burgess, stems from default configurations including open registration and unlimited repository creation, potentially exposing sensitive data and enabling server compromise. The vulnerability's persistence highlights a lack of timely patching by the Gogs maintainers, despite previous reports and exploitation.
The vulnerability, affecting versions 0.14.2 and 0.15.0+dev, allows attackers to leverage a malicious branch name within a Git rebase operation to inject the `--exec` flag, executing arbitrary code on the Gogs server. This could lead to the attacker gaining full control of the server, accessing all repositories, including private ones, and stealing credentials such as password hashes, API tokens, and SSH keys. The default configuration of open registration and unlimited repository creation significantly expands the attack surface, making it easier for unauthenticated attackers to exploit the flaw. The situation is compounded by the fact that the Gogs maintainers have been slow to respond to the initial report and subsequent requests for updates, despite acknowledging the vulnerability and previous exploitation events.