Privilege Escalation in Gogs via API Misconfiguration

Mitigation Strategies

The vulnerability is fixed in Gogs version 0.14.3. The immediate step to mitigate this vulnerability is to upgrade your Gogs installation to version 0.14.3 or later.

This update ensures that the three affected API endpoints are properly gated by reqRepoAdmin(), preventing write-level collaborators from performing unauthorized actions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unauthorized access to specific Gogs API endpoints by write-level collaborators. To detect exploitation attempts on your network or system, you can monitor HTTP requests targeting the following API endpoints:

• PATCH /api/v1/repos/:owner/:repo/issue-tracker
• PATCH /api/v1/repos/:owner/:repo/wiki
• POST /api/v1/repos/:owner/:repo/mirror-sync

You can use network monitoring tools or web server logs to identify requests to these endpoints made by users with write-level access but without admin privileges.

Example commands to search for such requests in web server logs (assuming logs are in common log format):

• grep -E 'PATCH /api/v1/repos/.+/issue-tracker' /var/log/gogs/access.log
• grep -E 'PATCH /api/v1/repos/.+/wiki' /var/log/gogs/access.log
• grep -E 'POST /api/v1/repos/.+/mirror-sync' /var/log/gogs/access.log

Additionally, correlate these requests with user roles to identify if any write-level collaborators are making these calls, which should be restricted to admins only.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Gogs, an open source self-hosted Git service, in versions prior to 0.14.3. Three API endpoints (PATCH /api/v1/repos/:owner/:repo/issue-tracker, PATCH /api/v1/repos/:owner/:repo/wiki, and POST /api/v1/repos/:owner/:repo/mirror-sync) are incorrectly protected by a permission check that only requires write-level access (reqRepoWriter) instead of admin-level access (reqRepoAdmin).

As a result, a collaborator with write access (but not admin access) can perform actions they should not be authorized to do, such as disabling the native issue tracker or wiki, injecting attacker-controlled external URLs that redirect repository visitors, or triggering mirror synchronization.

This discrepancy arises because the equivalent operations in the web UI require admin-level permissions, but the API endpoints do not enforce the same level of access control.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a collaborator with write access to perform unauthorized administrative actions on your repository.

• Disabling the native issue tracker or wiki, which could disrupt project management and documentation.
• Injecting attacker-controlled external URLs for the issue tracker or wiki, potentially redirecting repository visitors to malicious sites.
• Triggering mirror synchronization without proper authorization, which could lead to unintended data exposure or synchronization issues.

Overall, these unauthorized actions can compromise the integrity and security of your repository and its users.

Useful 0 Not Useful 0