Executive Summary

This vulnerability exists in Gogs, an open source self-hosted Git service, specifically in versions prior to 0.14.3. The issue is with the Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipynb, which improperly allows arbitrary data: URIs without sufficient restrictions.

The sanitizer uses bluemonday.UGCPolicy() with p.AllowURLSchemes("data"), which permits all data URI schemes, including data:text/html. This enables attackers to inject malicious HTML or JavaScript code, leading to Cross-Site Scripting (XSS).

Additionally, the endpoint lacks authentication middleware, meaning any registered user can exploit this vulnerability.

This vulnerability was fixed in version 0.14.3 of Gogs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to Cross-Site Scripting (XSS) attacks, where an attacker injects malicious HTML or JavaScript code into the application.

Because the sanitizer endpoint allows arbitrary data URIs and lacks authentication, any registered user can exploit this to execute malicious scripts in the context of other users.

Such attacks can result in unauthorized actions, data theft, session hijacking, or other malicious activities affecting users of the Gogs service.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Gogs to version 0.14.3 or later, where the issue with the Jupyter Notebook sanitizer endpoint has been fixed.

Since the vulnerability allows arbitrary data URIs including malicious HTML/JavaScript and lacks authentication middleware, restricting access to the sanitizer endpoint and applying proper authentication controls can help reduce risk until the upgrade is applied.

Useful 0 Not Useful 0