Gogs Git Rebase Argument Injection RCE

MetasploitMetasploit exploitExploitRubyexploit_multi/http/gogs_rebase_rce

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2026-52806, an argument injection vulnerability in Gogs (< 0.14.3). It creates a pull request with a malicious branch name containing '--exec=<CMD>' to achieve remote code execution during a rebase merge.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit exploit for CVE-2026-52806. It authenticates to a Gogs instance, creates or uses a repository, pushes a malicious branch name containing a `--exec=` argument injection, and triggers a rebase merge to execute the attacker-supplied payload. All behavior is consistent with the documented exploit flow. No concealed backdoor, unrelated payload, or operator-directed harm beyond the intended exploitation was observed.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagesruby
Target softwaregogs
Attack typescommand_injectionremote_code_execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises CVE-2026-52806 by injecting a malicious branch name to execute arbitrary commands on the target server. It includes all steps: authentication, repository setup, payload construction, branch pushing, pull request creation, and merge triggering.

modules/exploits/multi/http/gogs_rebase_rce.rb:1-757

Requirements

  • Authenticated Gogs user with repository creation or write/merge access to an existing repository.modules/exploits/multi/http/gogs_rebase_rce.rb:119-130
  • Local git installation required on the attacker's machine.modules/exploits/multi/http/gogs_rebase_rce.rb:194
  • Target Gogs instance must be vulnerable (version < 0.14.3).modules/exploits/multi/http/gogs_rebase_rce.rb:183-184

Observed behavior

  • Authenticates to the Gogs instance using username/password and creates an API token.modules/exploits/multi/http/gogs_rebase_rce.rb:204-207
  • Creates a new repository or validates access to an existing one, and enables rebase merge if configured.modules/exploits/multi/http/gogs_rebase_rce.rb:209-232
  • Constructs a malicious branch name containing '--exec=' with a base64-encoded payload (Unix) or a script file reference (Windows).modules/exploits/multi/http/gogs_rebase_rce.rb:234-259
  • Uses local git to push the malicious branch and a feature branch to the target repository.modules/exploits/multi/http/gogs_rebase_rce.rb:398-450
  • Creates a pull request between the malicious branch and the feature branch.modules/exploits/multi/http/gogs_rebase_rce.rb:498-525
  • Triggers a rebase merge via HTTP POST, causing the server to execute the injected command.modules/exploits/multi/http/gogs_rebase_rce.rb:527-553
  • Performs cleanup by deleting the repository (own_repo) or deleting branches and closing the PR (existing_repo).modules/exploits/multi/http/gogs_rebase_rce.rb:630-756
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Git rebase argument injection via branch name `--exec=<CMD>`The module constructs a branch name containing `--exec=` to inject a command into `git rebase`, which is the documented vulnerability.modules/exploits/multi/http/gogs_rebase_rce.rb:247modules/exploits/multi/http/gogs_rebase_rce.rb:258
Payload Execution
Executes attacker-supplied payload via `payload.encoded`The module uses the standard Metasploit payload mechanism; the payload is base64-encoded (Unix) or written to a script file (Windows) and executed by the injected command.modules/exploits/multi/http/gogs_rebase_rce.rb:239modules/exploits/multi/http/gogs_rebase_rce.rb:255
Authentication
Uses supplied USERNAME and PASSWORD to authenticate and create an API tokenThe module logs in via web form and creates a persistent API token for subsequent API calls; this is necessary for the exploit and is disclosed in the description.modules/exploits/multi/http/gogs_rebase_rce.rb:204-206modules/exploits/multi/http/gogs_rebase_rce.rb:297-315
Side Effect
API token persists after exploitation (no deletion endpoint)The module warns that the created API token cannot be automatically removed, which is a known limitation of the Gogs API.modules/exploits/multi/http/gogs_rebase_rce.rb:648-651
Review boundaries

What the analysis did not establish

  • Only the module source and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not expanded.
  • The evidence does not include any execution output or verification that the exploit works.
  • Review is limited to the module source and metadata; Metasploit framework mixins, libraries, and external payloads are not expanded or analyzed.
  • Binary files are flagged as metadata-only and were not inspected.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1