CVE-2022-1884
Published: 15 November 2024
Summary
CVE-2022-1884 is a critical-severity OS Command Injection (CWE-78) vulnerability in Gogs Gogs. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A remote command execution vulnerability affects gogs/gogs versions up to and including 0.12.7 when the application is deployed on Windows servers. It stems from insufficient validation of the tree_path parameter during file-upload operations, which permits an attacker to supply the value .git. and thereby place or overwrite files inside the repository's .git directory, including .git/config. The issue is tracked under CWE-78 and CWE-77 and carries a CVSS 3.1 base score of 9.8.
An unauthenticated remote attacker can exploit the flaw over the network by uploading a crafted file that sets core.sshCommand in the Git configuration; subsequent Git operations then execute arbitrary operating-system commands on the server, resulting in full compromise of confidentiality, integrity, and availability.
The sole reference points to a huntr.dev bounty report that describes the same root cause and impact; no additional advisory text or patch guidance is supplied in the available data. The associated EPSS score has remained flat at 0.1277 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6003
Vulnerability details
A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tree_path=.git.` to upload a file into…
more
the .git directory, allowing them to write or rewrite the `.git/config` file. If the `core.sshCommand` is set, this can lead to remote command execution.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.