CVE-2024-39932

Vulnerability

CVE-2024-39932 is an argument injection vulnerability in Gogs, a self-hosted Git service, affecting versions through 0.13.0. The flaw occurs during the previewing of changes, where unintended Git options are passed, leading to injection [1][4].

Exploitation

An unprivileged user account can exploit this by crafting a request to the changes preview feature. No authentication is required beyond having a user account; the attack is network-based and can be executed by any authenticated user with access to create or modify repositories [4].

Impact

Successful exploitation allows an attacker to write arbitrary files on the file system. This can be leveraged to force a re-installation of the Gogs instance, thereby granting administrator rights. The attacker can then access and alter any user's code hosted on the instance, potentially stealing source code or planting backdoors [1][4].

Mitigation

The official patch ignores unintended Git options for diff preview (#7871). Users should upgrade to Gogs 0.13.1 or the latest 0.14.0+dev. No viable workaround is available; restricting access to trusted users is recommended but does not fully mitigate the risk [4].