10 December blog post outlining its findings<\/a>.<\/p>\n
<\/p>\n
\u201cWe responsibly disclosed this vulnerability to the maintainers. They are currently working on a fix, but active exploitation continues in the wild.\u201d<\/p>\n
<\/p>\n
The issue is that the prior fix did not take into account Gogs\u2019 use of symbolic links, which can be exploited to overwrite target files outside any given repository, in turn leading to an attacker forcing the system to run arbitrary commands.<\/p>\n
<\/p>\n
According to Wiz, at the time of writing, there were about 1,400 internet-facing instances of Gogs (including several in Australia), and more than half of them were already compromised by Supershell-based malware.<\/p>\n
<\/p>\n
\u201cAll infected instances shared the same pattern: eight-character random owner\/repo names created within the same short time window (July 10th),\u201d Wiz said.<\/p>\n
<\/p>\n
\u201cThis suggests that a single actor, or perhaps a group of actors all using the same tooling, are responsible for all infections.\u201d<\/p>\n
<\/p>\n
As of writing, the issue remains unpatched.<\/p>\n","protected":false},"excerpt":{"rendered":"The United States Cybersecurity and Infrastructure Security Agency has added a new remote code execution vulnerability impacting the…\n","protected":false},"author":2,"featured_media":405846,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[49,48,61],"class_list":["post-405845","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-ca","tag-canada","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/405845","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/comments?post=405845"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/405845\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media\/405846"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media?parent=405845"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/categories?post=405845"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/tags?post=405845"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}