.. / CVE-2020-15867

• RCE
• Nuclei
• Web

Exploit for Gogs 0.5.5 - 0.12.2 - Remote Code Execution (CVE-2020-15867)

Description:

Gogs 0.5.5 through 0.12.2 is susceptible to authenticated remote code execution via the git hooks functionality. There can be a privilege escalation if access to this feature is granted to a user who does not have administrative privileges. NOTE: Since this is mentioned in the documentation but not in the UI, it could be considered a “product UI does not warn user of unsafe actions” issue.

Nuclei Template

View the template here CVE-2020-15867.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2020/CVE-2020-15867.yaml

References: