Critical Argument Injection Flaw in Gogs Remains Unpatched
Authenticated users can exploit a critical flaw in Gogs, posing security risks for internal Git deployments.
A critical argument injection vulnerability (CVE details pending) in the Gogs Git service allows authenticated users to execute arbitrary code on a Gogs server by creating a pull request with a malicious branch name. The vulnerability, unearthed by Rapid7 researcher Ryan Emmons, remains unpatched as the Gogs maintainers have not responded to disclosure attempts over the past two months.
Gogs, a lightweight and self-hosted Git service, is often used internally rather than exposed to the public internet. Its deployment model assumes internal network security—a flawed assumption with this vulnerability in play. Attackers who gain initial access can exploit this vulnerability to tamper with source code, exfiltrate data like password hashes, and potentially escalate to broader network intrusions.
Rapid7's analysis highlights the ease of exploitation: open registration by default means an unauthenticated attacker can create a user account, set up a repository, and execute the exploit chain independently. The vulnerability does not require administrative privileges or interaction with other users, making it a low-barrier attack vector.
David Shipley from Beauceron Security underscores the urgency: with the vulnerability public, attackers will be quick to exploit it. Gogs users are urged to restrict network access and disable user self-registration to mitigate risks. These steps are critical until a patch is available.
Gogs is favored for its operational simplicity and flexibility across platforms like Linux, macOS, and Windows. However, this disclosure highlights a significant downside: the lack of a dedicated security team means vulnerabilities can linger unpatched, unlike more robustly supported platforms such as GitHub.
Alternative self-hosted Git solutions include GitLab, Gitea, and Bitbucket Data Center, which may offer more timely security support. Until a resolution is provided, organizations using Gogs should remain vigilant and consider bolstering their internal security measures.
