Server-Side Request Forgery in gogs webhook in gogs.io/gogs

The SSRF vulnerability in gogs.io/gogs allows an attacker to craft malicious webhook payloads that trigger the server to make requests to internal services or external websites. This could lead to the exposure of sensitive data stored within the gogs instance, such as repository contents, user credentials, or configuration files. An attacker could also leverage this vulnerability to scan the internal network for open ports and services, potentially identifying other vulnerable systems. The blast radius extends to any internal resources accessible via HTTP from the gogs server, and external resources if the server is configured to allow outbound connections.

Organizations using gogs.io/gogs for self-hosted Git repositories are at risk, particularly those with internal services accessible via HTTP. Legacy gogs installations and deployments with overly permissive webhook configurations are especially vulnerable.

• linux / server:

journalctl -u gogs | grep -i "server-side request forgery"

• generic web:

curl -I <gogs_url>/hooks/github/your_webhook_url | grep -i "Location:"

1. 2024-08-21Disclosure

   disclosure

1. Reserviert2022-04-09
2. Veröffentlicht2024-08-21
3. Geändert2026-03-03
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2022-1285 is to upgrade to version 0.12.8 or later of gogs.io/gogs. If an immediate upgrade is not feasible, consider implementing a Web Application Firewall (WAF) to filter outbound HTTP requests from the gogs server, blocking requests to suspicious or unauthorized domains. Additionally, restrict network access to the gogs server to only necessary ports and services. Review and tighten webhook configurations to prevent malicious payloads from being processed. After upgrade, confirm by verifying the gogs version is 0.12.8 or higher.