CVE-2022-2024 OS Command Injection in gogs/gogs
Attackers can execute arbitrary OS commands on the server hosting Gogs, requiring an upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-2024?
CVE-2022-2024 is a critical command injection vulnerability in gogs/gogs, published on 25 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.
Weakness: CWE-78
Which versions are affected by CVE-2022-2024?
3 open source packages ship an affected version, including gogs.io/gogs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gogs.io/gogs Go | All versions | 0.12.11 |
gogs.io/gogs Go | All versions | 0.12.11 |
gogs.io/gogs Go | All versions | 0.12.11 |
Products include Gogs Gogs.
How do I fix CVE-2022-2024?
Upgrade gogs.io/gogs to 0.12.11 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-2024 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2024 exists.
Other vulnerabilities in gogs/gogs
Sources
Also known as GHSA-pfvh-p8qp-9ww9, GO-2023-1596.