SSRF in repository migration

published 2022-03-14 4y ago modified 2026-03-03 8mo ago also GO-2022-0377

cvss: 5.0; version 3.0, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Impact

The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected.

### Patches

Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.

### Workarounds

Run Gogs in its own private network.

### References

https://www.huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531/

### For more information

If you have any questions or comments about this advisory, please post on #6754.

Patch / fix

fixed in 1

go gogs.io/gogs 0.12.5

Is GHSA-q347-cg56-pcq4 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.0	5.0	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
go	gogs.io/gogs	<0.12.5	0.12.5

Classification

Weakness

CWE-918 Server-Side Request Forgery

References

github.com /gogs/gogs/security/advisories/GHSA-q347-cg56-pcq4
web, advisory
github.com /gogs/gogs
package
huntr.dev /bounties/327797d7-ae41-498f-9bff-cc0bf98cf531
web

Sources

GitHub Advisory GHSA-q347-cg56-pcq4
OSV GO-2022-0377

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.