CVE-2024-39930

CRITICAL

Gogs has an argument Injection in the built-in SSH server

Published December 23, 2024Updated December 23, 2024Source: osv

Summary

### Impact When the built-in SSH server is enabled (`[server] START_SSH_SERVER = true`), unprivileged user accounts with at least one SSH key can execute arbitrary commands on the Gogs instance with the privileges of the user specified by `RUN_USER` in the configuration. It allows attackers to access and alter any users' code hosted on the same instance. ### Patches The `env` command sent to the internal SSH server has been changed to be a passthrough (https://github.com/gogs/gogs/pull/7868), i.e. the feature is effectively removed. Users should upgrade to 0.13.1 or the latest 0.14.0+dev. ### Workarounds [Disable the use of built-in SSH server](https://github.com/gogs/gogs/blob/7adac94f1e93cc5c3545ea31688662dcef9cd737/conf/app.ini#L76-L77) on operating systems other than Windows. ### References https://www.cve.org/CVERecord?id=CVE-2024-39930

Remediation

Upgrade to the fixed version using your package manager.

Update gogs.io/gogs to 0.13.1 or later

go get gogs.io/gogs@v0.13.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Package	Ecosystem	Affected	Fixed In
gogs.io/gogs	go	All versions	0.13.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-88
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.9 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N

References

Frequently Asked Questions

What is CVE-2024-39930?: Gogs has an argument Injection in the built-in SSH server This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.9/10).
How do I check if my project is affected by CVE-2024-39930?: CVE-2024-39930 affects gogs.io/gogs. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-39930 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.9

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-vm62-9jw3-c8w3

GHSA-p69r-v3h4-rj4f

GO-2024-2969

Related CVEs

CVE-2022-1986
CRITICAL
OS Command Injection in file editor in Gogs
CVE-2026-52811
CRITICAL
Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym
CVE-2024-39932
CRITICAL
Gogs allows argument injection during the previewing of changes
CVE-2026-52813
CRITICAL
Gogs has Path Traversal in organization name that results in RCE through Git hooks
CVE-2026-25921
CRITICAL
Gogs: Cross-repository LFS object overwrite via missing content hash verification
CVE-2025-64111
CRITICAL
Gogs's update .git/config file allows remote command execution
CVE-2026-52805
HIGH
Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft
CVE-2025-8110
HIGH
Gogs vulnerable to a bypass of CVE-2024-55947

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies