The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote…
The built-in SSH server in Gogs through 0.13.0 contains an argument injection flaw in internal/ssh/ssh.go. Remote code execution is possible by an authenticated attacker who connects over SSH and sends a malicious --split-string environment request, provided the built-in SSH server is enabled; Windows installations are not affected.
The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated. Windows installations are unaffected.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) appeared 12 months after disclosure. No confirmed exploitation is recorded.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+12 mo
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV2 packages in 1 ecosystem. No single main package: each of these ships the affected code.
- Gogogs.io/gogsAffected: All versions before 0.13.1Upgrade to 0.14.3 or later
- Gogithub.com/gogs/gogsAffected: All versionsNo fixed version published