Gogs is an open source self-hosted Git service. Prior to 0.14.0, as an authorized user, an intruder can dictate the value which is passed to the git diff command which, together with bypassing the filtering of the passed value, allows the user to bypass the target directory and write the result of the comparison to any arbitrary path. This vulnerability is fixed in 0.14.0.

Affected: Go: gogs.io/gogs

**Vulnerability type:** Path Traversal **Impact:** DoS **Exploitation prerequisite:** authorized user **Description:** As an authorized user, an intruder can dictate the value which is passed to the `git diff` command which, together with bypassing the filtering of the passed value, allows the user to bypass the target directory and write the result of the comparison to any arbitrary path. **Researcher:** Artyom Kulakov (Positive Technologies) **Mitigation:** 1. https://github.com/gogs/gogs/blob/b7372b1f32cd0bb40984debfb049e3fc04efaee4/internal/route/repo/editor.go#L307 — on this line, instead of the `treePath` variable, which comes directly from the user unchanged, we should first filter and then pass the `entry` variable. 2. To filter the `treePath` variable, it is better to use the preexisting `pathutil.Clean` function instead of `path.Clean` from the standard Go library. ### Exploitation A Positive Technologies researcher discovered that the user has the ability to preview their changes when editing a file in the repository. The `POST /:user/:repo/_preview/:branch/:path_to_file` method is responsible for displaying the changes. The problem is how the `POST /:user/:repo/_preview/:branch/:path_to_file` method processes the value passed to the `:path_to_file` (see Listing 1). ###### Listing 1. _preview method processor ```Go func DiffPreviewPost(c *context.Context, f form.EditPreviewDiff) { // В treePath попадает значение из :path_to_file treePath := c.Repo.TreePath…

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Gogs ausnutzen, um einen Denial of Service Angriff durchzuführen.