Gogs Symbolic Link RCE

A critical Remote Code Execution vulnerability in Gogs (Go Git Service) via symbolic link abuse in Git repositories. Over 700 vulnerable instances were identified on the internet, and the vulnerability was exploited as a zero-day before a patch was available.

## Vulnerability Overview
Gogs is a self-hosted Git service written in Go. This vulnerability allows an unauthenticated attacker (or any user with repository creation privileges) to achieve RCE by pushing a specially crafted Git repository containing symbolic links that escape the repository root.

## Technical Details
- **Type:** Symbolic Link Following → Arbitrary File Read/Write → RCE (CWE-59)
- **Root Cause:** Gogs does not properly validate symbolic links within Git repositories during push operations. An attacker can create a symlink pointing to /etc/passwd, ~/.ssh/authorized_keys, or the Gogs configuration file, then overwrite it with malicious content.
- **RCE Path:** Overwrite Gogs' app.ini configuration to enable Git hooks, then push a repository with a malicious post-receive hook.

## Zero-Day Timeline
- Vulnerability discovered in active exploitation
- Over 700 internet-facing Gogs instances confirmed vulnerable via Shodan
- Patch released in Gogs 0.14.0 after responsible disclosure

## Impact
- Complete server compromise
- Access to all Git repositories hosted on the instance
- Theft of source code and credentials stored in repositories