Gogs, an opensource project for self hosting git has a critical RCE vulnerability that is unpatched. Rapid7 discovered the vulnerability on March 17th, the Gogs maintainers acknowledged the initial report, and then ceased contact. Rapid7 has disclosed the vuln today, Friday, May 29th, as per their disclosure timeline. The vulnerability is not yet known to be exploited in the wild. It does however have a Metasploit module ready to go, so we can expect exploitation in the near future.
Rapid7’s Report:
Actions:
With the absence of a patch available, Rapid7 has a few suggested mitigations in order of effectiveness.
Restrict user registration: Since the vulnerability requires a user account, restricting the creation of new users prevents potential threat actors from creating new users in order to exploit the vulnerability. This is done by setting DISABLE_REGISTRATION = true in the app.ini file.
Restricting repo creation: This prevents the easiest method of exploitation by preventing users from creating their own repos with Rebase enabled. This is done by setting MAX_CREATION_LIMIT = 0 in the app.ini file. This can also be set, per user, in the admin panel as Max Repo Creation.
Auditing rebase merge settings: Disable ‘Rebase Before Merging’ under Settings → Advanced → Rebase Before Merging. This prevents an attacker from using shared repos to exploit the vulnerability, assuming that the attacker does not have admin access to the shared repo.
Notes:
A very in depth report on the incident by Jessica Lyons at the Register: