Gogs Arbitrary File Write to RCE (CVE-2025-8110) - Educational Use Exploit

This repository contains a Proof of Concept (PoC) script in Python to demonstrate and analyze the vulnerability registered as CVE-2025-8110 in the self-hosted Git service Gogs (versions 0.13.3 and earlier).

⚠️ Disclaimer

[!WARNING] THIS SOFTWARE IS PROVIDED SOLELY FOR EDUCATIONAL AND SECURITY RESEARCH PURPOSES. Using this material against targets without prior written consent from their owners is completely illegal. The author of this repository is not responsible for any damages, losses, or misuse arising from the use of this code. Always use it at your own risk and only in controlled environments or authorized simulations (such as CTF labs).

What is CVE-2025-8110?

CVE-2025-8110 is a critical Arbitrary File Write vulnerability caused by insufficient validation when handling symbolic links (symlinks) through Gogs' PutContents API.

Impact Mechanism

An authenticated attacker can:

1. Create a local Git repository containing a symbolic link that points to a sensitive file outside the repository folder (for example, the server's own .git/config configuration file).
2. Push this repository to the Gogs server.
3. Use the Gogs API to modify the symbolic link file. Since the API does not verify if the target is a shortcut, the underlying operating system follows the link and overwrites system files with the privileges under which Gogs is running.
4. If Gogs runs as root, the file write can be escalated to Remote Code Execution (RCE) by injecting the desired command into the sshCommand property of Git's configuration file.

Code Explanation (exploit.py)

The script automates the entire exploitation process using valid credentials and an API Token previously generated manually in the Gogs web interface:

          ┌──────────────────────────────────────────────┐
          │          Máquina del Atacante (Kali)         │
          └──────────────────────┬───────────────────────┘
                                 │
         (1) Crea Repositorio    │ (3) Sube Symlink (.git/config)
         Malicioso vía API       │     vía git push
                                 ▼
          ┌──────────────────────────────────────────────┐
          │      Túnel SSH Local (puerto 8080)           │
          └──────────────────────┬───────────────────────┘
                                 │
                                 ▼
          ┌──────────────────────────────────────────────┐
          │           Servidor Víctima Gogs              │
          │              (Puerto 3001)                   │
          └──────────────────────┬───────────────────────┘
                                 │
                                 │ (4) API PUT "contents"
                                 │     Sigue Symlink y escribe
                                 │     "sshCommand" en .git/config
                                 ▼
          ┌──────────────────────────────────────────────┐
          │     Ejecución del Payload como ROOT          │
          └──────────────────────────────────────────────┘

Main Script Components:

1. create_malicious_repo: Makes a POST request to the Gogs API (/api/v1/user/repos) authenticating with the provided access token to create a new repository with a dynamically generated random name.
2. upload_malicious_symlink:
   • Clones the newly created repository to the local temporary folder /tmp/.
   • Creates a symbolic link locally on the attacker's machine pointing to .git/config (the server's Git configuration file).
   • Makes a commit and pushes the changes back to the server using a system command (git push).
3. exploit: Defines the payload using an injection trick in Git's sshCommand property. By updating the content through the API, Gogs is forced to overwrite its own .git/config on the server. When the final part of Git's process is triggered, Gogs executes the terminal command (a reverse shell in Bash) returning the connection to your Netcat listener.

Lab Usage Guide (HTB - Silentium)

Prerequisites

Make sure to configure global Git identity settings before running the script to avoid errors when performing the automatic commit:

git config --global user.email "[email protected]"
git config --global user.name "estudiante"

Usage: python3 exploit.py -u (http://127.0.0.1:8080) -lh <YOUR_VPN_IP> -lp 4446