Path Traversal in Gogs Git Service

Compliance Impact

The vulnerability allows cross-tenant disclosure of any Git LFS object, including sensitive data such as certificates, keys, or personally identifiable information (PII). This unauthorized access to private repository content could lead to violations of data protection regulations like GDPR and HIPAA, which mandate strict controls over access to sensitive and personal data.

Because the exploit enables persistent unauthorized access until manually revoked, organizations using affected versions of Gogs may face compliance risks related to data confidentiality and integrity requirements under these standards.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Gogs, an open source self-hosted Git service, prior to version 0.14.3. The issue arises because Git LFS (Large File Storage) objects are stored based only on their OID (object ID) without proper verification. When a user uploads a file, the system skips re-uploading if the file with the same OID already exists on disk and inserts a new database entry linking the user's repository to that OID without verifying that the uploaded content actually matches the OID.

As a result, any user with write access to one repository can link their repository to an OID owned by a private repository and download the original file bytes through their own download endpoint, effectively bypassing repository access controls.

This vulnerability was fixed in version 0.14.3 of Gogs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized data access. Specifically, a user with write access to one repository can access and download files from private repositories they should not have access to by exploiting the way Git LFS objects are referenced and stored.

This could result in exposure of sensitive or confidential data stored in private repositories, potentially leading to data breaches or leakage of proprietary information.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in Gogs version 0.14.3. To mitigate this vulnerability, you should upgrade your Gogs installation to version 0.14.3 or later.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unauthorized access to Git LFS objects by exploiting the deduplication logic in Gogs versions prior to 0.14.3. Detection would involve monitoring for unusual Git LFS upload or download activity, especially HTTP PUT requests that bind repositories to OIDs without proper verification.

Specifically, you can look for HTTP write access requests (PUT) to the LFS upload endpoints that attempt to bind an OID already existing on disk but with content that does not match the OID hash.

While no explicit detection commands are provided in the resources, network monitoring tools or web server logs can be used to identify suspicious LFS upload requests. For example, you can use commands like the following to search web server logs for suspicious PUT requests to LFS endpoints:

• grep 'PUT /lfs/' /var/log/nginx/access.log
• grep -i 'upload' /var/log/gogs/gogs.log

Additionally, monitoring for multiple repositories binding to the same OID or unexpected repository bindings in the `lfs_object` table in the database could indicate exploitation attempts.

Upgrading to version 0.14.3 or later is the recommended mitigation to prevent exploitation.

Useful 0 Not Useful 0