automatic module_metadata_base.json update

Author: msjenkins-r7

db/modules_metadata_base.json

@@ -74900,6 +74900,67 @@
     },
     "needs_cleanup": null
   },
+  "exploit_multi/http/gitea_git_hooks_rce": {
+    "name": "Gitea Git Hooks Remote Code Execution",
+    "fullname": "exploit/multi/http/gitea_git_hooks_rce",
+    "aliases": [
+
+    ],
+    "rank": 600,
+    "disclosure_date": "2020-10-07",
+    "type": "exploit",
+    "author": [
+      "Podalirius",
+      "Christophe De La Fuente"
+    ],
+    "description": "This module leverages an insecure setting to get remote code\n          execution on the target OS in the context of the user running Gitea.\n          This is possible when the current user is allowed to create `git\n          hooks`, which is the default for administrative users. For\n          non-administrative users, the permission needs to be specifically\n          granted by an administrator.\n\n          To achieve code execution, the module authenticates to the Gitea web\n          interface, creates a temporary repository, sets a `post-receive` git\n          hook with the payload and creates a dummy file in the repository.\n          This last action will trigger the git hook and execute the payload.\n          Everything is done through the web interface.\n\n          It has been mitigated in version 1.13.0 by setting the Gitea\n          `DISABLE_GIT_HOOKS` configuration setting to `true` by default. This\n          disables this feature and prevents all users (including admin) from\n          creating custom git hooks.\n\n          This module has been tested successfully against docker versions 1.12.5,\n          1.12.6 and 1.13.6 with `DISABLE_GIT_HOOKS` set to `false`, and on\n          version 1.12.6 on Windows.",
+    "references": [
+      "CVE-2020-14144",
+      "EDB-49571",
+      "URL-https://podalirius.net/articles/exploiting-cve-2020-14144-gitea-authenticated-remote-code-execution/",
+      "URL-https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1126-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/"
+    ],
+    "platform": "Linux,Unix,Windows",
+    "arch": "cmd, x86, x64",
+    "rport": 3000,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": [
+      "Unix Command",
+      "Linux Dropper",
+      "Windows Command",
+      "Windows Dropper"
+    ],
+    "mod_time": "2021-04-07 19:40:59 +0000",
+    "path": "/modules/exploits/multi/http/gitea_git_hooks_rce.rb",
+    "is_install_path": true,
+    "ref_name": "multi/http/gitea_git_hooks_rce",
+    "check": true,
+    "post_auth": true,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ]
+    },
+    "needs_cleanup": null
+  },
   "exploit_multi/http/gitlab_file_read_rce": {
     "name": "GitLab File Read Remote Code Execution",
     "fullname": "exploit/multi/http/gitlab_file_read_rce",
@@ -75267,6 +75328,67 @@
     },
     "needs_cleanup": null
   },
+  "exploit_multi/http/gogs_git_hooks_rce": {
+    "name": "Gogs Git Hooks Remote Code Execution",
+    "fullname": "exploit/multi/http/gogs_git_hooks_rce",
+    "aliases": [
+
+    ],
+    "rank": 600,
+    "disclosure_date": "2020-10-07",
+    "type": "exploit",
+    "author": [
+      "Podalirius",
+      "Christophe De La Fuente"
+    ],
+    "description": "This module leverages an insecure setting to get remote code\n          execution on the target OS in the context of the user running Gogs.\n          This is possible when the current user is allowed to create `git\n          hooks`, which is the default for administrative users. For\n          non-administrative users, the permission needs to be specifically\n          granted by an administrator.\n\n          To achieve code execution, the module authenticates to the Gogs web\n          interface, creates a temporary repository, sets a `post-receive` git\n          hook with the payload and creates a dummy file in the repository.\n          This last action will trigger the git hook and execute the payload.\n          Everything is done through the web interface.\n\n          No mitigation has been implemented so far (latest stable version is\n          0.12.3).\n\n          This module has been tested successfully against version 0.12.3 on\n          docker. Windows version could not be tested since the git hook feature\n          seems to be broken.",
+    "references": [
+      "CVE-2020-15867",
+      "EDB-49571",
+      "URL-https://podalirius.net/articles/exploiting-cve-2020-14144-gitea-authenticated-remote-code-execution/",
+      "URL-https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1126-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/"
+    ],
+    "platform": "Linux,Unix,Windows",
+    "arch": "cmd, x86, x64",
+    "rport": 3000,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": [
+      "Unix Command",
+      "Linux Dropper",
+      "Windows Command",
+      "Windows Dropper"
+    ],
+    "mod_time": "2021-04-07 19:40:59 +0000",
+    "path": "/modules/exploits/multi/http/gogs_git_hooks_rce.rb",
+    "is_install_path": true,
+    "ref_name": "multi/http/gogs_git_hooks_rce",
+    "check": true,
+    "post_auth": true,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ]
+    },
+    "needs_cleanup": null
+  },
   "exploit_multi/http/horde_csv_rce": {
     "name": "Horde CSV import arbitrary PHP code execution",
     "fullname": "exploit/multi/http/horde_csv_rce",