Vulnerability · Published Jul 4, 2024 · Assigned by mitre
CVE-2024-39930
Critical 9.9
In plain English
A critical-severity argument injection in the github.com/gogs/gogs package (Go). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 7.7% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated. Windows installations are unaffected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/gogs/gogs | no fix listed | GHSA-p69r-v3h4-rj4f |
| Go | github.com/gogs/gogs | no fix listed | GO-2024-2969 |
| Go | gogs.io/gogs | 0.13.1 | GHSA-vm62-9jw3-c8w3 |
Affected products (as reported)
Weakness: CWE-88 · Vector: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N