Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code
The well-known open-source self-hosted Git service Gogs has been found to have a serious security flaw that permits an authenticated user to run any code under specific circumstances.
According to Rapid7, the security issue has a CVSS score of 9.4. There is no CVE identifier for it.
According to security researcher Jonah Burgess, the vulnerability enables any authorized user to accomplish remote code execution (RCE) on the server by generating a pull request with a malicious branch name that injects the --exec flag into git rebase during the "Rebase before merging" merge operation.
Rebasing is a Git action that creates a linear project history by replaying a series of commits from one feature branch on top of another base branch. While "git rebase" and "git merge" both address th...