CVE-2024-39930: Gogs has an argument Injection in the built-in SSH server
When the built-in SSH server is enabled ([server] START_SSH_SERVER = true), unprivileged user accounts with at least one SSH key can execute arbitrary commands on the Gogs instance with the privileges of the user specified by RUN_USER in the configuration. It allows attackers to access and alter any users’ code hosted on the same instance.
References
- github.com/advisories/GHSA-vm62-9jw3-c8w3
- github.com/gogs/gogs
- github.com/gogs/gogs/security/advisories/GHSA-vm62-9jw3-c8w3
- nvd.nist.gov/vuln/detail/CVE-2024-39930
- www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1
- www.vicarius.io/vsociety/posts/argument-injection-in-gogs-ssh-server-cve-2024-39930
Code Behaviors & Features
Detect and mitigate CVE-2024-39930 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →