Description

Gogs Missing Authorization in Attachment Download

Summary

In Gogs 0.14.1, GET /attachments/:uuid returns the raw attachment file without verifying whether the requester has view permission for the associated Issue/Comment/Release or the repository. In a test environment with REQUIRE_SIGNIN_VIEW = false, we confirmed that an unauthenticated user can download attachments belonging to a private repository.

Description

/attachments/:uuid retrieves an attachment record solely by the UUID provided in the URL and returns the corresponding local file without performing any authorization checks against the attachment’s parent object (Issue/Comment/Release) or the repository it belongs to. As a result, even attachments under private repositories can be downloaded by an unauthenticated user (or a user without proper permissions) as long as the UUID is known.

Relevant code (internal/cmd/web.go:306):

m.Get("/attachments/:uuid", func(c *context.Context) {
	attach, err := database.GetAttachmentByUUID(c.Params(":uuid"))
	if err != nil {
		c.NotFoundOrError(err, "get attachment by UUID")
		return
	} else if !com.IsFile(attach.LocalPath()) {
		c.NotFound()
		return...
Show more

The UUID lookup itself also performs no validation tied to repository visibility or user permissions. Authorization is not enforced at this layer.

Relevant code (internal/database/attachment.go:124):

// GetAttachmentByUUID returns attachment by given UUID.
func GetAttachmentByUUID(uuid string) (*Attachment, error) {
	return getAttachmentByUUID(x, uuid)
}

Preconditions

The attacker knows the target attachment’s UUID (i.e., the attachment URL).

For unauthenticated exploitation: [auth] REQUIRE_SIGNIN_VIEW = false.

Even when REQUIRE_SIGNIN_VIEW = true, exploitation may still be possible because the handler does not check repository-level permissions; a user who can log in but lacks access to the target repository may still retrieve the attachment.

Steps to Reproduce

Log in as an administrator and create a private repository, e.g. myadmin/idor-attach-1770724346-1a13bb.

Add an attachment to an Issue in that repository and note the attachment UUID (example UUID used during testing: f06d90f8-5b62-4c10-ac8d-f11fdf870b57).

Log out and access the following as an unauthenticated user:

The repository page → 404 Not Found



The Issue page under that repository → 404 Not Found



GET /attachments/<uuid> → the attachment file is successfully downloaded

Minimum Required Privileges

REQUIRE_SIGNIN_VIEW = false: none (works without authentication).

REQUIRE_SIGNIN_VIEW = true: only the ability to log in (repository view permission is not required in practice).

Impact

Confidential information attached to private repositories or restricted Issues/Releases may be disclosed.

Examples include credentials, cryptographic keys, personal data, internal documents, or unpublished source code fragments.

While the severity depends on the attachment contents, attachments frequently contain sensitive data, making the potential impact high.

Mitigation

Aliases

References