Unauthenticated DoS in Gogs via SSH Connection Handling

Executive Summary

This vulnerability affects Gogs, an open source self-hosted Git service, specifically versions prior to 0.14.3. The built-in Go SSH server in Gogs does not enforce read/write deadlines on incoming TCP connections. An unauthenticated attacker can exploit this by opening multiple TCP connections to the SSH port and withholding the SSH protocol banner. This causes the server to spawn an unlimited number of goroutines that wait indefinitely for socket input/output, leading to resource exhaustion.

As a result, the server runs out of file descriptors, which prevents legitimate users from accessing the Git SSH service and can destabilize the entire Gogs process, including causing failures in internal operations like log rotation.

This issue is classified as an asymmetric Denial of Service (DoS) attack and was fixed in version 0.14.3 of Gogs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing a Denial of Service on your Gogs Git SSH service. An attacker can exhaust server resources by opening many TCP connections without completing the SSH handshake, which leads to the server running out of file descriptors.

As a consequence, legitimate users will be unable to access the Git SSH service, disrupting development workflows and potentially causing instability in the Gogs application, including failures in internal processes such as log rotation.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Gogs to version 0.14.3 or later where the issue is fixed.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring the number of open TCP connections to the Gogs SSH port and checking for an unusually high number of connections that do not complete the SSH handshake (i.e., connections where the SSH protocol banner is not sent). Such connections cause the server to spawn many goroutines and exhaust file descriptors.

You can use network and system commands to identify suspicious connections and resource exhaustion symptoms:

• Use netstat or ss to list TCP connections to the SSH port (default 22 or custom port used by Gogs):
• netstat -anp | grep ':22' | grep ESTABLISHED
• ss -tnp sport = :22
• Look for many connections in a state where the SSH handshake is not progressing (e.g., connections established but no data transferred).
• Check the number of goroutines and file descriptors used by the Gogs process to detect resource exhaustion:
• Use lsof to count open file descriptors for the Gogs process:
• lsof -p <gogs_pid> | wc -l
• Use pprof or runtime profiling tools to inspect goroutine counts if available.

If you observe a large number of TCP connections stuck waiting for the SSH banner and a high number of goroutines or file descriptors consumed by the Gogs process, it indicates exploitation of this vulnerability.

Useful 0 Not Useful 0