Intrusion PreventionGogs.File.Upload.tree_path.Command.Injection
Description
This indicates an attack attempt to exploit a Command Injection Vulnerability in Gogs.
The vulnerability is due to improper validation on the tree_path parameter when uploading files to a repository. A remote, authenticated attacker could exploit this vulnerability by sending a crafted request to the target server and overwriting the repository configuration file. Successful exploitation will result in arbitrary OS command execution on the target server.
Affected Products
Gogs 0.12.5 and prior
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
https://github.com/gogs/gogs/security/advisories/GHSA-5gjh-5j4f-cpwv
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 51503 |
| Created | Apr 28, 2022 |
| Updated | May 17, 2022 |
| Risk |
|
| CVE ID | CVE-2022-0415 |
| Exploit Prediction Score | 11.76% |
| Default Action | drop |
| Active | |
| Affected OS | Windows, Linux, MacOS |
| Affected App | Other |