Gogs CVE-2024-56731

This vulnerability presents CRITICAL real-world risk across multiple dimensions: (1) CVSS Vector indicates maximum severity with network-based attacks (AV:N), no authentication required (PR:N), no user interaction (UI:N), and complete scope change (S:C), affecting confidentiality, integrity, and availability (C:H/I:H/A:H). (2) Attack complexity is LOW (AC:L), indicating straightforward exploitation without special conditions. (3) The vulnerability is unauthenticated and remotely exploitable, making it accessible to any attacker with network access. (4) The incomplete patch status (CVE-2024-39931 not fully resolved) suggests attackers have likely already identified bypass techniques. (5) Command execution occurs with RUN_USER privileges, typically a service account with repository access, enabling lateral movement and data exfiltration across all hosted repositories. (6) This is not a theoretical high-CVSS issue—it represents immediate, practical exploitation risk for any Gogs instance running versions prior to 0.13.3. The SSVC framework would rate this IMMEDIATE for patching: exploitation is straightforward, automation is feasible (shell command injection), and technical impact is complete system compromise.

An unauthenticated attacker discovers a target organization running Gogs 0.13.2. The attacker sends a crafted HTTP request to the Gogs API or web interface, exploiting the incomplete .git directory access controls to delete critical git hook files (e.g., post-receive hooks). The attacker then creates a malicious post-receive hook that executes shell commands. When a legitimate user or automated process pushes code to the repository, the hook triggers, executing the attacker's injected commands (e.g., creating a reverse shell, exfiltrating credentials, installing persistence mechanisms) with the privileges of the RUN_USER account. This grants the attacker persistent access to the Gogs server and potential lateral movement to other systems. Alternatively, if a proof-of-concept exploit exists (likely, given the publicly disclosed nature and perfect CVSS score), attackers may be using automated scanning and exploitation against publicly exposed Gogs instances. The attack requires zero authentication, zero user interaction, and exploits a straightforward file deletion+injection technique, making it highly likely to be actively exploited in the wild.