When the built-in SSH server is enabled ([server] START_SSH_SERVER = true), unprivileged user accounts with at least one SSH key can execute arbitrary commands on the Gogs instance with the privileges of the user specified by RUN_USER in the configuration. It allows attackers to access and alter any users' code hosted on the same instance.
The env command sent to the internal SSH server has been changed to be a passthrough (https://github.com/gogs/gogs/pull/7868), i.e. the feature is effectively removed. Users should upgrade to 0.13.1 or the latest 0.14.0+dev.
Disable the use of built-in SSH server on operating systems other than Windows.
https://www.cve.org/CVERecord?id=CVE-2024-39930
| Score | Percentile |
|---|---|
| 11.88% | 93.50% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 10.0 | 3.1 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-vm62-9jw3-c8w3 ↗ |
| CVE | CVE-2024-39930 ↗ |
| CWE id | Name |
|---|---|
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| go | gogs.io/gogs | <= 0.13.0 | 0.13.1 | — |