Executive Summary

This vulnerability exists in Gogs, an open source self-hosted Git service, in versions prior to 0.14.3. The issue is an unauthenticated information disclosure where the API endpoint GET /api/v1/orgs/:orgname/teams returns all teams for any organization without requiring authentication.

The problem arises because the route group handling this endpoint lacks the required authentication middleware (reqToken()), and the handler function listTeams() does not perform any authentication checks. As a result, anyone can access team IDs, names, descriptions, and permission levels without logging in.

This vulnerability was fixed in version 0.14.3 of Gogs.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated information disclosure of team details such as IDs, names, descriptions, and permission levels in Gogs prior to version 0.14.3.

Such unauthorized exposure of organizational information could potentially lead to non-compliance with data protection regulations like GDPR or HIPAA, which require protection of sensitive information and control over access.

However, the provided context does not explicitly state the impact on compliance with these standards.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by exposing sensitive organizational information without any authentication. Specifically, an attacker or unauthorized user can retrieve details about all teams within any organization hosted on the vulnerable Gogs instance.

• Exposure of team IDs, which could be used to target specific teams.
• Disclosure of team names and descriptions, potentially revealing internal structure or sensitive project information.
• Exposure of permission levels, which could aid attackers in understanding access controls and planning further attacks.

Overall, this information disclosure could facilitate social engineering, reconnaissance, or targeted attacks against the organization.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access the vulnerable endpoint without authentication and observing if team information is disclosed.

• Send an unauthenticated GET request to the endpoint /api/v1/orgs/:orgname/teams on your Gogs instance.
• Example command using curl: curl -X GET http://<gogs-server>/api/v1/orgs/<orgname>/teams
• If the response contains team IDs, names, descriptions, and permission levels without requiring authentication, the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade Gogs to version 0.14.3 or later, where the issue is fixed.

Useful 0 Not Useful 0