Unpatched Gogs Argument Injection (CVSS 9.4): Critical RCE Detection and Mitigation

---
title: Gogs Argument Injection via Git Rebase Exec
id: a1b2c3d4-5678-490a-bcde-123456789012
status: experimental
description: Detects potential argument injection in Gogs via suspicious git rebase commands containing the --exec flag.
references:
 - https://www.rapid7.com/blog/post/ve-authenticated-rce-via-argument-injection-gogs-unfixed
author: Security Arsenal
date: 2025/04/10
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/git'
    CommandLine|contains:
      - 'rebase'
      - '--exec'
  condition: selection
falsepositives:
  - Legitimate administrative use of git rebase --exec (rare in automated services)
level: critical
---
title: Web Server Spawning Shell via Git Service
id: b2c3d4e5-6789-490a-bcde-234567890123
status: experimental
description: Detects Gogs or Go web server spawning a shell or suspicious binary, indicative of successful RCE.
references:
 - https://www.rapid7.com/blog/post/ve-authenticated-rce-via-argument-injection-gogs-unfixed
author: Security Arsenal
date: 2025/04/10
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/gogs'
      - '/go' # if running from source
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/nc'
      - '/curl'
      - '/wget'
  condition: all of selection_*
falsepositives:
  - Administrative troubleshooting on the Gogs server
level: high


**KQL (Microsoft Sentinel / Defender)**

DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName =~ "git.exe" or ProcessName =~ "git"
| where ProcessCommandLine contains "rebase" and ProcessCommandLine contains "--exec"
| extend HostName = DeviceName, Account = AccountName
| project Timestamp, HostName, Account, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc


**Velociraptor VQL**

-- Hunt for git rebase processes with the --exec flag
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()\WHERE Name =~ 'git'
  AND CommandLine =~ 'rebase'
  AND CommandLine =~ '--exec'


**Remediation Script (Bash)**

#!/bin/bash

# Gogs Emergency Hardening Script
# Usage: sudo ./gogs_hardening.sh

echo "[+] Starting Gogs Hardening Checks..."

# 1. Locate Gogs configuration file (common paths)
GOGS_CONF_PATHS=("/etc/gogs/conf/app.ini" "/opt/gogs/custom/conf/app.ini" "/home/git/gogs/custom/conf/app.ini")
CONFIG_FOUND=""

for path in "${GOGS_CONF_PATHS[@]}"; do
  if [ -f "$path" ]; then
    CONFIG_FOUND="$path"
    break
  fi
done

if [ -z "$CONFIG_FOUND" ]; then
  echo "[!] ERROR: Gogs configuration file (app.ini) not found in common locations."
  echo "    Please manually verify DISABLE_REGISTRATION in your app.ini."
  exit 1
fi

echo "[+] Found Gogs configuration at: $CONFIG_FOUND"

# 2. Check and Disable Open Registration
echo "[+] Checking DISABLE_REGISTRATION setting..."
if grep -q "^DISABLE_REGISTRATION.*=.*false" "$CONFIG_FOUND"; then
  echo "[!] WARNING: Open registration is ENABLED."
  read -p "    Do you want to disable registration now? (y/n) " -n 1 -r
  echo
  if [[ $REPLY =~ ^[Yy]$ ]]; then
    sed -i 's/^DISABLE_REGISTRATION.*/DISABLE_REGISTRATION = true/' "$CONFIG_FOUND"
    echo "[+] Hardening applied: Registration disabled."
    echo "[!] ACTION REQUIRED: Restart the Gogs service to apply changes."
  else
    echo "[-] Skipped configuration change."
  fi
elif grep -q "^DISABLE_REGISTRATION.*=.*true" "$CONFIG_FOUND"; then
  echo "[+] Good: Registration is already disabled."
else
  echo "[!] NOTICE: DISABLE_REGISTRATION setting not explicitly found or commented out."
  echo "    Appending 'DISABLE_REGISTRATION = true' to configuration."
  echo "" >> "$CONFIG_FOUND"
  echo "[server]" >> "$CONFIG_FOUND"
  echo "DISABLE_REGISTRATION = true" >> "$CONFIG_FOUND"
  echo "[+] Hardening applied. Restart Gogs service."
fi

# 3. Identify Gogs service user for hunting scope
echo "[+] Identifying Gogs process owner..."
PGOGS=$(ps aux | grep '[g]ogs' | awk '{print $1}' | head -n 1)
if [ -n "$PGOGS" ]; then
  echo "[+] Gogs is running as user: $PGOGS"
  echo "    Scope your threat hunts to processes spawned by user '$PGOGS'."
else
  echo "[-] Gogs process not currently detected as running."
fi

echo "[+] Hardening script complete."


---