GHSA-pm6v-2h4w-4rp2: Gogs: Overwriting critical files results in a denial of service

Vulnerability type: Path Traversal Impact: DoS Exploitation prerequisite: authorized user Description: As an authorized user, an intruder can dictate the value which is passed to the git diff command which, together with bypassing the filtering of the passed value, allows the user to bypass the target directory and write the result of the comparison to any arbitrary path. Researcher: Artyom Kulakov (Positive Technologies) Mitigation: 1. https://github.com/gogs/gogs/blob/b7372b1f32cd0bb40984debfb049e3fc04efaee4/internal/route/repo/editor.go#L307 — on this line, instead of the treePath variable, which comes directly from the user unchanged, we should first filter and then pass the entry variable. 2. To filter the treePath variable, it is better to use the preexisting pathutil.Clean function instead of path.Clean from the standard Go library. Exploitation A Positive Technologies researcher discovered that the user has the ability to preview their changes when editing a file in the repository. The POST /:user/:repo/_preview/:branch/:path_to_file method is responsible for displaying the changes. The problem is how the POST /:user/:repo/_preview/:branch/:path_to_file method processes the value passed to the :path_to_file (see Listing 1). Listing 1. _preview method processor func DiffPreviewPost(c *context.Context, f form.EditPreviewDiff) { // В treePath попадает значение из :path_to_file treePath := c.Repo.TreePath // Проверка, что файл существует в репозитории entry, err := c.Repo.Commit.TreeEntry(treePath) -cut- // Значение, полученное от пользователя, передается в функцию в обход фильтра diff, err := c.Repo.Repository.GetDiffPreview(c.Repo.BranchName, treePath, f.Content) -cut- The first problem to solve is to make the TreeEntry function think that the value passed in is a file that actually exists in the repository. To do this, we must consider how the TreeEntry function actually makes this decision (see Listing 2). Listing 2. Path checking and cleaning function