Stored XSS in Gogs via Unrestricted data URI in Sanitizer

Compliance Impact

The vulnerability in Gogs allows Cross-Site Scripting (XSS) attacks via the Jupyter Notebook sanitizer endpoint, which could lead to unauthorized execution of malicious scripts when viewing notebook files.

Such XSS vulnerabilities can potentially lead to unauthorized access to sensitive data or user sessions, which may impact compliance with data protection regulations like GDPR or HIPAA that require safeguarding personal and sensitive information.

However, the provided information does not explicitly discuss the direct impact of this vulnerability on compliance with specific standards or regulations.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Gogs, an open source self-hosted Git service, specifically in versions prior to 0.14.3. The issue is with the Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipynb, which improperly allows arbitrary data: URIs without sufficient restrictions.

The sanitizer uses bluemonday.UGCPolicy() with p.AllowURLSchemes("data"), which permits all data URI schemes, including data:text/html. This enables attackers to inject malicious HTML or JavaScript code, leading to Cross-Site Scripting (XSS).

Additionally, the endpoint lacks authentication middleware, meaning any registered user can exploit this vulnerability.

This vulnerability was fixed in version 0.14.3 of Gogs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to Cross-Site Scripting (XSS) attacks, where an attacker injects malicious HTML or JavaScript code into the application.

Because the sanitizer endpoint allows arbitrary data URIs and lacks authentication, any registered user can exploit this to execute malicious scripts in the context of other users.

Such attacks can result in unauthorized actions, data theft, session hijacking, or other malicious activities affecting users of the Gogs service.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Gogs to version 0.14.3 or later, where the issue with the Jupyter Notebook sanitizer endpoint has been fixed.

Since the vulnerability allows arbitrary data URIs including malicious HTML/JavaScript and lacks authentication middleware, restricting access to the sanitizer endpoint and applying proper authentication controls can help reduce risk until the upgrade is applied.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your Gogs instance is running a version prior to 0.14.3 and if the POST /-/api/sanitize_ipynb endpoint is accessible without authentication.

You can attempt to detect the vulnerability by sending a crafted POST request to the vulnerable endpoint with a payload containing a data URI using a potentially malicious MIME type such as data:text/html and observing if the response improperly sanitizes it.

Example command using curl to test the endpoint:

• curl -X POST https://your-gogs-instance/-/api/sanitize_ipynb -d '{"content":"data:text/html,<script>alert(1)</script>"}' -H 'Content-Type: application/json' -v

If the response contains the script tag or the data URI is not properly sanitized, the system is vulnerable.

Additionally, checking the version of Gogs running on your system can help determine if the vulnerability is present, as versions 0.14.3 and later include the fix.

Useful 0 Not Useful 0