CVE-2024-39930

CVSS 9.9 CRITICALEPSS 7.3%CWE-88

The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated. Windows installations are unaffected.

CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N

Produtos afetados

n/a · n/a

PoCs públicas encontradas — 4

githubgithub.com/theMcSam/CVE-2024-39930-PoC★ 0 githubgithub.com/alexander47777/-CVE-2024-39930★ 0 githubgithub.com/laachy/CVE-2024-39930-ptrace-detection-mitigation★ 0 exploitdbwww.exploit-db.com/exploits/52348não verificado

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/gogs/gogs/releases https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1/https://www.vicarius.io/vsociety/posts/argument-injection-in-gogs-ssh-server-cve-2024-39930