GHSA-q347-cg56-pcq4 SSRF in repository migration
A malicious user can exploit repository migration to discover internal network services, requiring an upgrade to Gogs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-q347-cg56-pcq4?
GHSA-q347-cg56-pcq4 is a server-side request forgery vulnerability in gogs.io/gogs, published on 14 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Impact
The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected.
Patches
Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.
Workarounds
Run Gogs in its own private network.
References
https://www.huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531/
For more information
If you have any questions or comments about this advisory, please post on #6754.
Which versions are affected by GHSA-q347-cg56-pcq4?
3 open source packages ship an affected version, including gogs.io/gogs.
| Package | Affected | Fixed in |
|---|---|---|
gogs.io/gogs Go | All versions | 0.12.5 |
gogs.io/gogs Go | All versions | 0.12.5 |
gogs.io/gogs Go | All versions | 0.12.5 |
How do I fix GHSA-q347-cg56-pcq4?
Upgrade gogs.io/gogs to 0.12.5 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is GHSA-q347-cg56-pcq4 being exploited?
There is no known exploitation of GHSA-q347-cg56-pcq4 in the wild and no public exploit code.
Sources
Also known as GO-2022-0377.