GHSA-pj96-4jhv-v792 Cross site scripting via cookies in gogs
An attacker can manipulate CSRF cookies to trigger self-XSS in Gogs, potentially bypassing security controls for the malicious user.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-pj96-4jhv-v792?
GHSA-pj96-4jhv-v792 is a cross-site scripting vulnerability in gogs.io/gogs, published on 2 Jun 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Impact
There is no known practical impact other than it is just possible to manipulate CSRF cookie and XSS the malicious user self.
Patches
Invalid characters of CSRF tokens are stripped after reading cookie. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.
Workarounds
No need for workarounds.
References
N/A
For more information
If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6953.
Which versions are affected by GHSA-pj96-4jhv-v792?
3 open source packages ship an affected version, including gogs.io/gogs.
| Package | Affected | Fixed in |
|---|---|---|
gogs.io/gogs Go | All versions | 0.12.8 |
gogs.io/gogs Go | All versions | 0.12.8 |
gogs.io/gogs Go | All versions | 0.12.8 |
How do I fix GHSA-pj96-4jhv-v792?
Upgrade gogs.io/gogs to 0.12.8 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-pj96-4jhv-v792 being exploited?
There is no known exploitation of GHSA-pj96-4jhv-v792 in the wild and no public exploit code.
Sources
Also known as GO-2022-0473.