Remote Command Execution in file editing in gogs in gogs.io/gogs

The impact of CVE-2024-54148 is severe. An unauthenticated attacker can exploit this vulnerability to execute arbitrary commands on the Gogs server. This could lead to complete system compromise, including data exfiltration, malware installation, and denial of service. The attacker could potentially gain persistent access to the server and compromise other systems on the network if the Gogs server has access to internal resources. This vulnerability is particularly concerning given the potential for remote, unauthenticated exploitation.

Organizations running self-hosted Gogs instances, particularly those with publicly accessible repositories or limited access controls, are at significant risk. Shared hosting environments where multiple users share a single Gogs instance are also highly vulnerable, as a compromised user account could be used to exploit this vulnerability and gain access to the entire server.

• linux / server: Monitor Gogs logs for unusual file modification patterns, especially those containing shell commands. Use journalctl -u gogs to filter for relevant events.

journalctl -u gogs | grep -i "command injection"

• go / supply-chain: Examine Gogs source code for instances of unsanitized user input used in shell commands. Review dependencies for known vulnerabilities. • generic web: Attempt to exploit the file editing functionality by injecting shell commands into file names or content. Use curl to test endpoint exposure.

curl -X POST -d "<malicious_command>" <gogs_url>/edit/<filename>

1. 2025-01-07Disclosure

   disclosure

1. Reserviert2024-11-29
2. Veröffentlicht2025-01-07
3. Geändert2026-03-03
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-54148 is to upgrade Gogs to version 0.13.1 or later. If immediate upgrading is not possible, consider restricting file editing access to trusted users only. Implement strict input validation on all file editing parameters to prevent command injection. Monitor Gogs logs for suspicious activity, particularly related to file modifications. While a WAF may offer some protection, it is not a substitute for patching the vulnerability.