CVE-2024-39933: Argument Injection Vulnerability in Gogs
Summary
CVE-2024-39933: Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
- gogs.io/gogs · Go
The same CVE-2024-39933 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Gogs is an open-source self-hosted Git service written in Go. It provides a lightweight and efficient way to manage repositories, users, and organizations. Gogs allows users to create and tag new releases, which can be used to mark specific versions of a project. However, a vulnerability has been discovered in Gogs that allows argument injection during the tagging process.
Vulnerability Detail
The argument injection vulnerability in Gogs occurs when creating a new release. An attacker can manipulate the arguments passed to the tagging function, potentially leading to unauthorized actions or code execution. This vulnerability can be exploited by an authenticated user with the ability to create releases. The impact of this vulnerability depends on the actions allowed by the tagging function and the privileges of the user. It could result in unauthorized access, data manipulation, or even remote code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the ability to create new releases in Gogs until the software is updated. This can be done by modifying the configuration settings or by restricting the privileges of users who have the ability to create releases.
Conclusion
The argument injection vulnerability in Gogs allows attackers to manipulate the tagging process during the creation of new releases. This can lead to unauthorized actions or code execution, depending on the privileges of the user. Users are advised to update their Gogs installation to the latest version to mitigate the risk. Additionally, disabling the ability to create new releases can serve as a temporary workaround until the software is updated.
See every vulnerability recorded for github.com/gogs/gogs →
FAQ
Gogs is a self-hosted Git service written in Go. It provides a lightweight and efficient way to manage repositories, users, and organizations.
The argument injection vulnerability in Gogs occurs when creating a new release. An attacker can manipulate the arguments passed to the tagging function, potentially leading to unauthorized actions or code execution.
Users of Gogs versions prior to the latest release are affected by this vulnerability. Any user with the ability to create releases is potentially at risk.
The impact of this vulnerability depends on the actions allowed by the tagging function and the privileges of the user. It could result in unauthorized access, data manipulation, or even remote code execution.
To fix this vulnerability, users should update their Gogs installation to the latest version, which includes a patch for the argument injection vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gogs/gogs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
