id: CVE-2022-0870

info:
  name: Gogs - SSRF
  author: Akincibor
  severity: medium
  description: Server-Side Request Forgery (SSRF) in Gogs prior to 0.12.5.
  reference:
    - https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0870
    - https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb
    - https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2022-0870
    cwe-id: CWE-918
  metadata:
    shodan-query: http.favicon.hash:-449283196
  tags: cve,cve2022,ssrf,gogs,huntr

requests:
  - method: GET
    path:
      - "{{BaseURL}}"

    extractors:
      - type: regex
        name: version
        internal: true
        group: 1
        regex:
          - '<div class="ui left">\n\s+© \d{4} Gogs Version: ([\d.]+) Page:'

      - type: regex
        group: 1
        regex:
          - '<div class="ui left">\n\s+© \d{4} Gogs Version: ([\d.]+) Page:'

    matchers-condition: and
    matchers:

      - type: regex
        part: body
        regex:
          - '<div class="ui left">\n\s+© \d{4} Gogs Version: ([\d.]+) Page:'

      - type: dsl
        dsl:
          - compare_versions(version, '< 0.12.5')

      - type: status
        status:
          - 200