CVE-2022-2024 — Vulnerability in gogs.io/gogs — CVE Details

CRITICAL

Gogs OS Command Injection vulnerability

Published February 28, 2023Updated August 20, 2024Source: osv

Summary

### Impact The malicious user is able to update a crafted `config` file into repository's `.git` directory in combination with crafted file deletion to gain SSH access to the server on case-insensitive file systems. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) on case-insensitive file systems (Windows, macOS, etc.) are affected. ### Patches Make sanitization of upload path to `.git` directory to be case-insensitive. Users should upgrade to 0.12.11 or the latest 0.13.0+dev. ### Workarounds Disable [repository upload](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129). ### References https://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97/ ### For more information If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7030.

Advisory Timeline

First published February 28, 2023 (1322 days ago).
Last revised August 20, 2024 — 539 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update gogs.io/gogs to 0.12.11 or later

go get gogs.io/gogs@v0.12.11

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: go (1).

Package	Ecosystem	Affected	Fixed In
gogs.io/gogs	go	All versions	0.12.11

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-78
OS Command InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2022-2024?: Gogs OS Command Injection vulnerability This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2022-2024?: CVE-2022-2024 affects gogs.io/gogs. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-2024 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-pfvh-p8qp-9ww9

GO-2023-1596

Related CVEs

CVE-2022-1986
CRITICAL
OS Command Injection in file editor in Gogs
CVE-2026-52811
CRITICAL
Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym
CVE-2024-39932
CRITICAL
Gogs allows argument injection during the previewing of changes
CVE-2026-52813
CRITICAL
Gogs has Path Traversal in organization name that results in RCE through Git hooks
CVE-2024-39930
CRITICAL
Gogs has an argument Injection in the built-in SSH server
CVE-2024-56731
CRITICAL
Gogs allows deletion of internal files which leads to remote command execution
CVE-2026-26022
HIGH
Gogs: Stored XSS via data URI in issue comments
CVE-2026-52816
MEDIUM
Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies