CVE-2022-1884
Remote Command Execution in gogs/gogs
概要
Remote Command Execution in gogs/gogs
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the tree_path parameter during file uploads. An attacker can set tree_path=.git. to upload a file into the .git directory, allowing them to write or rewrite the .git/config file. If the core.sshCommand is set, this can lead to remote command execution.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory nvd.nist.gov
- web huntr.com