Post · bonfire.cafe

Catalin Cimpanu

@campuscodi@mastodon.social · 1 hour ago

There's an unpatched RCE in Gogs after the project maintainers mysteriously stopped answering Rapid7 a month ago

https://www.rapid7.com/blog/post/ve-authenticated-rce-via-argument-injection-gogs-unfixed/

Authenticated RCE via Argument Injection in Gogs (NOT FIXED)

Rapid7 researchers found that Gogs allows authenticated users to achieve RCE on the server by creating a pull request with a specially crafted branch name. More in our latest analysis blog.

0

No replies yet

Be the first to share your thoughts.