GHSA-pwx3-qcgw-vh7h: Gogs Vulnerable to CSRF Leading to Organization Owner Takeover

Summary In Gogs 0.14.1, organization team member management can be performed via GET requests without CSRF protection. If a victim who is an organization owner is logged in and is tricked into visiting a crafted link, an attacker-controlled user can be added to the Owners team. As a result, the attacker gains organization owner–equivalent privileges. Description When a victim is logged in as an organization owner, team member management endpoints are exposed via routes reachable by GET requests, allowing state-changing operations without a CSRF token. Team action route allows GET internal/cmd/web.go:390 m.Route("/teams/:team/action/:action", "GET,POST", org.TeamsAction) CSRF validation is applied only to POST requests Because the global CSRF check is limited to POST requests, state-changing operations reached via GET bypass CSRF protection entirely. internal/context/auth.go:56-61 if !options.SignOutRequired && !options.DisableCSRF && c.Req.Method == "POST" && !isAPIPath(c.Req.URL.Path) { csrf.Validate(c.Context, c.csrf) if c.Written() { return } } TeamsAction performs state changes regardless of HTTP method TeamsAction does not branch on the HTTP method. Instead, it performs state-changing operations (such as adding or removing members) based solely on query parameters (uid, uname) and the :action path parameter. Since the route explicitly allows GET, the add action can be executed via GET. internal/route/org/teams.go:38-83 func TeamsAction(c *context.Context) { uid := com.StrTo(c.Query("uid")).MustInt64() if uid == 0 { c.Redirect(c.Org.OrgLink + "/teams") return } page := c.Query("page") var err error switch c.Params(":action") { case "add": if !c.Org.IsOwner { c.NotFound() return } uname := c.Query("uname") var u *database.User u, err = database.Handle.Users().GetByUsername(c.Req.Context(), uname) // ... err = c.Org.Team.AddMember(u.ID) page = "team" } } Adding a user to the Owners team grants organization owner privileges When a user joins the Ow