CVE-2020-15867: 
Gogs vulnerability analysis and mitigation

The git hook feature in Gogs versions 0.5.5 through 0.12.2 contains a vulnerability that allows for authenticated remote code execution. The vulnerability can lead to privilege escalation if access to the git hook feature is granted to users without administrative privileges (CVE Details).

The vulnerability is similar to CVE-2020-14144 found in Gitea (a fork of Gogs). When a user has permissions to create Git hooks, which is the default setting for administrators, they can execute code on the server through the web interface. This capability can also be granted to non-administrative users, making it a potential privilege escalation vector (AttackerKB).

The vulnerability allows authenticated users with git hook permissions to execute arbitrary code on the server. If the feature is granted to non-administrative users, it can be exploited for privilege escalation. The severity is reflected in its CVSS v3 Base Score of 7.2, with high impact scores for confidentiality, integrity, and availability (AttackerKB).

The vulnerability requires authentication and elevated access to exploit. A Metasploit module (exploit/multi/http/gogs_git_hooks_rce) is available for exploitation, making it relatively easy to weaponize despite requiring specific conditions (AttackerKB).

The recommended mitigation is to set the DISABLE_GIT_HOOKS configuration setting to true, which completely disables the git hooks feature and prevents all users, including administrators, from creating custom Git hooks (AttackerKB).