CVE-2024-39932: Gogs allows argument injection during the previewing of changes

December 23, 2024

Unprivileged user accounts can write to arbitrary files on the filesystem. We could demonstrate its exploitation to force a re-installation of the instance, granting administrator rights. It allows accessing and altering any user’s code hosted on the same instance.

References

github.com/advisories/GHSA-9pp6-wq8c-3w2c
github.com/gogs/gogs
github.com/gogs/gogs/security/advisories/GHSA-9pp6-wq8c-3w2c
nvd.nist.gov/vuln/detail/CVE-2024-39932
www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1

Code Behaviors & Features

Detect and mitigate CVE-2024-39932 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →