Gogs RCE Vulnerability via Pull Request Branch Name Injection
Gogs versions prior to 0.15.0 are reportedly vulnerable to Remote Code Execution (RCE) through a specially crafted pull request branch name. Users of affected versions should assess their exposure and consider upgrading.
What happened
An early warning has been issued regarding a critical vulnerability in Gogs, tracked as GHSA-QF6P-P7WW-CWR9. This vulnerability, reportedly affecting versions of Gogs prior to 0.15.0, allows authenticated users to achieve Remote Code Execution (RCE) on the server. The attack vector involves creating a pull request with a specially crafted branch name that injects the `--exec` flag into the `git rebase` command during the 'Rebase before merging' merge operation.
The vulnerability is under investigation, and the recommended action is to upgrade to Gogs 0.15.0 or later, which includes the fix for this issue. Users of affected versions should assess their exposure and consider upgrading as a precautionary measure. For more detailed information, consult the primary sources linked in the threat data.
How 0Day mitigates this
gogs is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.