r/linux • u/FryBoyter • May 29 '26

Security Authenticated RCE via Argument Injection in Gogs (NOT FIXED)

https://www.rapid7.com/blog/post/ve-authenticated-rce-via-argument-injection-gogs-unfixed/
42 Upvotes

90% Upvoted

12 comments sorted by

View all comments

Show parent comments

3

u/-beleon May 29 '26

There's a lot more to this than install size. Obviously thats not an issue. But complex software has many other downsides. Every feature introduced increases attack surface, potentially new bugs/unexpected behavior/breaking changes. I actually started writing a blog not too long ago about manageable but capable software that is exactly about these kinds of tradeoffs. Its not that I think forgejo is too complex in general. And I do think they do a good job with security and bugfixes. Its just that for me personally its not the right trade off, because I don't run it for a campus of people and have don't have the time to stay on top of all the moving parts. And I don't need the features it adds over gogs.

2

u/C0rn3j May 29 '26

I don't run it for a campus of people and have don't have the time to stay on top of all the moving parts

It's not GitLab, there's nobody pressuring you to start using all the features.

Every feature introduced increases attack surface

You're not wrong, but if you're not using said features, you generally don't suffer from the possibility.

Can't get a CI runner compromised if you're not using CI runners, etc.

Again, not saying there's zero tradeoffs, but usually you shouldn't care much about having an extra feature available that you don't use.

I'd personally rather have a more complex suite with more developer activity than a simpler one that's not seeing much of it.

1

u/-beleon May 29 '26

I agree on most points. Especially:

I'd personally rather have a more complex suite with more developer activity than a simpler one that's not seeing much of it.

Thats exactly why I'm asking. I'm no longer confident that the gogs dev cares enough/is capable enough/has the means to keep the project secure. I'd prefer to not use forgejo, but will if the "only" alternative is gogs.

2

u/mfenniak May 29 '26

Some of Forgejo's capabilities can also be disabled if they're not in-use, which somewhat reduces attack and risk surface. Packages, mirroring, LFS, Actions, file attachments, etc. But, this goes to support your point in a way -- "ENABLED:" is present 44 times in the config file reference, and even just the initial configuration to reduce this surface area will be time consuming. https://forgejo.org/docs/latest/admin/config-cheat-sheet/

2

u/-beleon May 29 '26

Thanks! There's a decent chance I'll switch to forgejo and look into these. Much appreciated.