Open-source package vulnerability · Go

CVE-2024-39930: Gogs has an argument Injection in the built-in SSH server

criticalCVSS 3.1 9.9GHSA-vm62-9jw3-c8w3

Impact When the built-in SSH server is enabled ([server] STARTSSHSERVER = true), unprivileged user accounts with at least one SSH key can execute arbitrary commands on the Gogs instance with the privileges of the user specified by RUNUSER in the configuration. It allows attackers to access and alter any users' code hosted on the same instance.

Published Dec 23, 2024

Affected packages

gogs.io/gogs

Ecosystem: Go
Affected: <= 0.13.0
Fixed in: 0.13.1
Check: go list -m gogs.io/gogs

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

When the built-in SSH server is enabled ([server] START_SSH_SERVER = true), unprivileged user accounts with at least one SSH key can execute arbitrary commands on the Gogs instance with the privileges of the user specified by RUN_USER in the configuration. It allows attackers to access and alter any users' code hosted on the same instance.

Patches

The env command sent to the internal SSH server has been changed to be a passthrough (https://github.com/gogs/gogs/pull/7868), i.e. the feature is effectively removed. Users should upgrade to 0.13.1 or the latest 0.14.0+dev.

Workarounds

Disable the use of built-in SSH server on operating systems other than Windows.

References

https://www.cve.org/CVERecord?id=CVE-2024-39930

Credited to swapgs.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Go vulnerabilities

All Go entries