CVE-2024-39930

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.13.1

Description The built-in SSH server allows argument injection in internal/ssh/ssh.go, which can lead to remote code execution. Authenticated attackers with at least one SSH key can exploit this by opening an SSH connection and sending a malicious --split-string request via the env command if the built-in SSH server is enabled (configured as [server] START SSH SERVER = true). This allows the attacker to execute arbitrary commands with the privileges of the user specified by RUN USER in the configuration, potentially enabling access to or alteration of any user's code on the instance. Windows installations are not affected. Approximately 7,300 to 8,300 exposed instances have been identified.

Recommendations Upgrade to version 0.13.1 or the latest 0.14.0+dev. As a temporary workaround, disable the use of the built-in SSH server on non-Windows operating systems.