Gogs up to 0.11 isValidRedirect redirect_to

Summaryinfo

A vulnerability classified as problematic has been found in Gogs up to 0.11. The impacted element is the function isValidRedirect. The manipulation of the argument redirect_to as part of Parameter leads to redirect. This vulnerability is listed as CVE-2018-15178. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Gogs up to 0.11. It has been rated as critical. This issue affects the function isValidRedirect. The manipulation of the argument redirect_to as part of a Parameter leads to a redirect vulnerability. Using CWE to declare the problem leads to CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the user/login redirect_to parameter, related to the function isValidRedirect in routes/user/auth.go.

The bug was discovered 08/04/2018. The weakness was presented 08/08/2018 (Website). It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2018-15178 since 08/07/2018. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1204.001 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 3 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 0.12 eliminates this vulnerability.

See VDB-122725 for similar entry. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Gogs

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11

Website

• Product: https://github.com/gogs/gogs/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion