GitHub Advisoryadvisory · Go

GHSA-w689-557m-2cvq Server-Side Request Forgery in gogs webhook

HIGH Published 2022-06-03 Modified 2022-06-03 Official page ↗
Aliases
CVE-2022-1285
Ecosystem
Go
Packages
gogs.io/gogs
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Weaknesses
CWE-918
Reviewed
2022-06-03

Affected packages

• Go gogs.io/gogs: < 0.12.8 → fixed in 0.12.8

Description

Impact The malicious user is able to discover services in the internal network through webhook functionality. All installations accepting public traffic are affected. Patches Webhook payload URLs are revalidated before each delivery to make sure they are not resolved to blocked local network addresses. Users should upgrade to 0.12.8 or the latest 0.13.0+dev. Workarounds Run Gogs in its own private network. References https://huntr.dev/bounties/da1fbd6e-7a02-458e-9c2e-6d226c47046d/ For more information If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6901.

Related

Alias · CVE (1)

  • CVE-2022-1285 Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References