GitHub Advisoryadvisory · Go

GHSA-q347-cg56-pcq4 SSRF in repository migration

MEDIUM Published 2022-03-14 Modified 2022-03-14 Official page ↗
Ecosystem
Go
Packages
gogs.io/gogs
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Weaknesses
CWE-918
Reviewed
2022-03-14

Affected packages

• Go gogs.io/gogs: < 0.12.5 → fixed in 0.12.5

Description

Impact The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Patches Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev. Workarounds Run Gogs in its own private network. References https://www.huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531/ For more information If you have any questions or comments about this advisory, please post on #6754.

Related

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References