CVE-2018-15178: Open Redirect in gogs.io/gogs
Summary
CVE-2018-15178: Open Redirect. Affects gogs.io/gogs versions < 0.12.0. Fixed in 0.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs is an open-source self-hosted Git service written in Go. It provides a lightweight and easy-to-use platform for managing repositories, users, and organizations. The vulnerability identified as CVE-2018-15178 is an open redirect vulnerability that exists in Gogs versions prior to 0.12. This vulnerability allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks by manipulating the 'redirect_to' parameter in the user/login functionality. The issue originates from the 'isValidRedirect' function in the 'routes/user/auth.go' file.
Vulnerability Detail
The open redirect vulnerability in Gogs can be exploited by an attacker to trick users into visiting malicious websites by manipulating the 'redirect_to' parameter. By inserting an initial '/' substring in the 'redirect_to' parameter, an attacker can bypass the validation checks and redirect users to arbitrary URLs. This can lead to phishing attacks where users are tricked into entering sensitive information on fraudulent websites. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.0
This is the first release that contains the fix.
go get gogs.io/gogs@v0.12.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually validate and sanitize the 'redirect_to' parameter before processing it. This can be done by checking if the parameter starts with a valid URL prefix and rejecting any redirects to external domains. Here's an example of how to implement this workaround in Go:
func isValidRedirect(redirectURL string) bool {
validPrefixes := []string{"/", "http://", "https://"}
for _, prefix := range validPrefixes {
if strings.HasPrefix(redirectURL, prefix) {
return true
}
}
return false
}
By using this workaround, the risk of open redirect attacks can be mitigated until the system is upgraded to a secure version.
Conclusion
In conclusion, the open redirect vulnerability (CVE-2018-15178) in Gogs versions prior to 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks. It is crucial to upgrade to Gogs version 0.12.0 or later to fix this vulnerability and ensure the security of your system. Until the upgrade is performed, implementing the provided workaround can help mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for gogs.io/gogs →
FAQ
An open redirect vulnerability is a security flaw that allows an attacker to redirect users to arbitrary websites. It occurs when a web application does not properly validate or sanitize user-supplied input used for redirecting users. In the case of Gogs, the vulnerability allows attackers to manipulate the 'redirect_to' parameter and trick users into visiting malicious websites.
The open redirect vulnerability in Gogs can be exploited by attackers to conduct phishing attacks. By redirecting users to fraudulent websites that mimic legitimate ones, attackers can trick users into entering sensitive information such as login credentials, credit card details, or personal data. This can lead to identity theft, financial loss, or unauthorized access to user accounts.
You can use Vulert's playground at Vulert Scanner to check if your Gogs installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using Gopkg.lock to analyze the software without requiring access to the code or installation. Simply enter your Gogs repository URL in the playground to get instant results.
Yes, a fix for this vulnerability is available in Gogs version 0.12.0 and later. It is recommended to upgrade to the latest version to ensure that the vulnerability is patched and your system is secure. By keeping your software up to date, you can protect your users and prevent potential security breaches.
Yes, there is a temporary workaround that involves manually validating and sanitizing the 'redirect_to' parameter. By implementing proper checks to ensure that the parameter starts with a valid URL prefix and rejecting any redirects to external domains, you can mitigate the risk of open redirect attacks. However, it is still recommended to upgrade to the latest secure version of Gogs as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
