Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a .. session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gogs | Gogs | * | 0.11.66 (including) |
Such a scenario is commonly observed when: