Remote Code Execution in Gogs by Gogs Ltd.

CVE-2020-15867

What is CVE-2020-15867?

The git hook feature in Gogs versions ranging from 0.5.5 to 0.12.2 is susceptible to a remote code execution vulnerability. This issue arises when authenticated users are granted inappropriate permissions to execute code via the git hook feature, which can lead to privilege escalation. The risk is exacerbated by the lack of user interface warnings concerning unsafe actions, as this vulnerability is documented but not prominently displayed to users.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2020-15867
Created by Rapid7

References