Critical Gogs flaw enables complete code repository takeover
Take action: If you use Gogs self-hosted Git service, plan a quick upgrade to version 0.13.3. Your Gogs is vulnerable to a flaw that allows complete system takeover. If posible, isolate Gogs from the internet and if you can't upgrade right away, disable user registration in your Gogs configuration to prevent attackers from registering and exploiting this flaw. Then plan a patch cycle.
Learn More
Security researchers are reporting a critical vulnerability in the Gogs self-hosted Git service that allows authenticated attackers to execute arbitrary commands and gain complete control over code repositories through an insufficient security patch.
Gogs (Go Git Service) is a self-hosted Git service developed in the Go programming language that is designed to build simple, stable, and scalable code hosting platforms.
The vulnerability is tracked as CVE-2024-56731 (CVSS score 10.0), and exploits a symbolic link bypass in the previously patched CVE-2024-39931 flaw, enabling unprivileged users to delete critical system files and achieve remote command execution with administrative privileges.
In the patch for CVE-2024-39931, a security check was added to prevent uploading files into the ".git" directory, but there are no checks for symbolic links in the later steps, allowing attackers to create symbolic links that point to the .git directory and still delete arbitrary files.
The symbolic link bypass technique works because the Gogs application validates the target path during the initial security check but fails to resolve and validate symbolic links during the actual file operations.
Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration, allowing attackers to access and alter any users' code hosted on the same instance. This can cause intellectual property theft, malicious code injection into legitimate repositories, destruction of version control history, deployment of backdoors in software projects, and lateral movement to connected development infrastructure.
Since code repositories often contain sensitive information including deployment credentials, API keys, and proprietary algorithms, successful exploitation could enable supply chain attacks affecting downstream consumers of the hosted code.
The vulnerability affects all Gogs installations running version 0.13.2 and earlier.
Gogs has released version v0.13.3 to fix this vulnerability. Organizations using affected versions are strongly encouraged to patch their systems.
A quick Shodan search lists around 7,500 open Gogs instances visible on the internet.
Organizations unable to immediately upgrade to the patched version, should sett the Gogs configuration file app.ini to turn off the user registration function so access is limited to trusted group of people; external scanning of code and files to detect malicious file content or malicious operations on the .git directory, and restricting access to the system based on actual business conditions.
