Gogs Path Traversal in Organization Name Leading to RCE via Git Hooks

union isfuzzy=true
(
  W3CIISLog
  | where csUriStem has_any ("/org/create", "/api/v1/orgs")
    and (csUriQuery has ".." or csUriQuery matches regex @"[%2F]{2,}|\.\.[\/\\]")
  | project TimeGenerated, Computer, cIP, csMethod, csUriStem, csUriQuery, scStatus, csUserAgent
  | extend AlertDetail = "Potential path traversal in Gogs org name via HTTP request"
),
(
  Syslog
  | where ProcessName =~ "gogs" or SyslogMessage has "gogs"
  | where SyslogMessage has_any ("..", "../", "..%2F", "..%5C")
    and SyslogMessage has_any ("org", "organization", "hook")
  | project TimeGenerated, Computer, HostName, SyslogMessage
  | extend AlertDetail = "Gogs process log shows path traversal in org/hook context"
),
(
  SecurityEvent
  | where EventID in (4688, 4663)
  | where (NewProcessName has "gogs" or ProcessName has "gogs")
    or (ObjectName has ".git" and ObjectName has "hooks")
  | project TimeGenerated, Computer, Account, EventID, NewProcessName, CommandLine, ObjectName
  | extend AlertDetail = "Process or file event associated with Gogs Git hook path"
)
| extend CVE = "CVE-2026-52813"
| sort by TimeGenerated desc

index=web OR index=app OR index=os sourcetype IN ("access_combined", "iis", "gogs", "syslog", "WinEventLog:Security")
| eval is_traversal=if(match(uri_path, "\.\.[\/\\]") OR match(uri_query, "\.\.[\/\\]") OR match(uri_path, "%2e%2e") OR match(uri_query, "%2e%2e") OR match(uri_path, "\.\.%2[Ff]") OR match(uri_query, "\.\.%2[Ff]"), 1, 0)
| eval is_gogs_org=if(match(uri_path, "(?i)(org|organization)") OR match(uri_path, "/api/v1/orgs"), 1, 0)
| eval is_hook_activity=if(match(message, "(?i)hook") AND match(message, "(?i)\.git"), 1, 0)
| where (is_traversal=1 AND is_gogs_org=1) OR is_hook_activity=1
| eval cve="CVE-2026-52813"
| table _time, host, src_ip, uri_path, uri_query, status, message, cve
| sort -_time

sequence by host.name with maxspan=5m
  [network where process.name : ("gogs", "gogs.exe") and
   http.request.uri : ("*org*", "*organization*", "*/api/v1/orgs*") and
   (
     http.request.uri : ("*../*", "*..\\*", "*%2e%2e%2f*", "*%2e%2e%5c*", "*..%2f*", "*..%5c*")
     or http.request.body.content : ("*../*", "*..\\*", "*%2e%2e*")
   )
  ]
  [file where process.name : ("gogs", "gogs.exe") and
   file.path : ("*/.git/hooks/*", "*\\.git\\hooks\\*") and
   event.action in ("creation", "overwrite")
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  'CVE-2026-52813' AS cve,
  magnitude,
  category,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'Microsoft IIS', 'Linux OS', 'Custom Log Source')
  AND (
    (URL ILIKE '%org%' OR URL ILIKE '%organization%' OR URL ILIKE '%/api/v1/orgs%')
    AND (
      URL ILIKE '%../%'
      OR URL ILIKE '%..\\%'
      OR URL ILIKE '%.%2e%2f%'
      OR URL ILIKE '%..%2f%'
      OR URL ILIKE '%..%5c%'
      OR URL ILIKE '%%2e%2e%%'
    )
  )
  OR (
    payload ILIKE '%gogs%'
    AND payload ILIKE '%.git%'
    AND payload ILIKE '%hook%'
    AND (payload ILIKE '%../%' OR payload ILIKE '%..\\%')
  )
ORDER BY starttime DESC
LAST 24 HOURS

_sourceCategory=web/access OR _sourceCategory=app/gogs OR _sourceCategory=os/syslog
| parse regex "(?<uri_path>\/[^\s?]*)(?:\?(?<uri_query>[^\s]*))?" nodrop
| parse regex "\s(?<status_code>\d{3})\s" nodrop
| where (
    (uri_path matches "*org*" OR uri_path matches "*organization*" OR uri_path matches "*/api/v1/orgs*")
    AND (
      uri_path matches "*../*" OR uri_path matches "*..\\*" OR
      uri_query matches "*../*" OR uri_query matches "*..\\*" OR
      uri_path matches "*%2e%2e%2f*" OR uri_path matches "*%2e%2e%5c*" OR
      uri_path matches "*..%2f*" OR uri_path matches "*..%5c*"
    )
  )
  OR (
    _raw matches "*gogs*" AND _raw matches "*.git*" AND _raw matches "*hook*"
    AND (_raw matches "*../*" OR _raw matches "*..\\*")
  )
| fields _messageTime, _sourceHost, uri_path, uri_query, status_code
| sort by _messageTime desc

rule cve_2026_52813_gogs_path_traversal_rce {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects exploitation of CVE-2026-52813: path traversal in Gogs organization name leading to RCE via Git hooks"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/gogs/gogs/security/advisories/GHSA-c39w-43gm-34h5"

  events:
    (
      $e1.metadata.event_type = "NETWORK_HTTP"
      and (
        re.regex($e1.network.http.request_url, `(?i)(org|organization|api/v1/orgs)`)
      )
      and (
        re.regex($e1.network.http.request_url, `(\.\./|\.\\|%2e%2e%2f|%2e%2e%5c|\.\.%2f|\.\.%5c)`)
        or re.regex($e1.network.http.request_body, `(\.\./|\.\\|%2e%2e)`)
      )
    )
    or
    (
      $e1.metadata.event_type = "FILE_CREATION"
      and re.regex($e1.target.file.full_path, `(?i)\.git[/\\]hooks[/\\]`)
      and $e1.principal.process.file.full_path != ""
      and re.regex($e1.principal.process.file.full_path, `(?i)gogs`)
    )

  condition:
    $e1
}

#event_simpleName IN (NetworkConnectIP4, NetworkConnectIP6, ProcessRollup2, FileOpenInfo, FileWrittenInfo)
| $gogs_process = (ImageFileName = /gogs/i OR CommandLine = /gogs/i)
| $path_traversal_url = (RequestURL = /\.\.\/|\.\.%2[Ff]|%2e%2e%2[Ff]|%2e%2e%5[Cc]/i)
| $org_endpoint = (RequestURL = /org|organization|\/api\/v1\/orgs/i)
| $hook_write = (TargetFileName = /\.git[\/\\]hooks[\/\\]/i)
| ($path_traversal_url AND $org_endpoint) OR ($gogs_process AND $hook_write)
| table _time, aid, ComputerName, UserName, ImageFileName, CommandLine, RequestURL, TargetFileName
| sort _time desc