Authenticated RCE via Argument Injection in Gogs (NOT FIXED)
PoC publicGogs Read at Rapid7 Blog
Below is the opening; the full story is at Rapid7 Blog.
From Rapid7 Blog
Overview
Rapid7 Labs discovered a critical argument injection (CWE-88) vulnerability in Gogs, a popular open-source self-hosted Git service. Rapid7 Labs scores this vulnerability as CVSSv4 9.4 (Critical). The vulnerability allows any authenticated user to achieve remote code execution (RCE) on the server by creating a pull request with a malicious branch name that injects the --exec flag into git rebase during the "Rebase before merging" merge operation. At the time of publication, the vendor has not released a patch.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.