Exploits / Vulnerability Discovered : 2020-11-19 |
Type : webapps |
Platform : ruby
This exploit / vulnerability Gitlab 12.9.0 arbitrary file read (authenticated) is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: Gitlab 12.9.0 - Arbitrary File Read (Authenticated)
# Google Dork: -
# Date: 11/15/2020
# Exploit Author: Jasper Rasenberg
# Vendor Homepage: https://about.gitlab.com
# Software Link: https://about.gitlab.com/install
# Version: tested on gitlab version 12.9.0
# Tested on: Kali Linux 2020.3
#You can create as many personal access tokens as you like from your GitLab profile.
# Sign in to GitLab.
# In the upper-right corner, click your avatar and select Settings.
# On the User Settings menu, select Access Tokens.
# Choose a name and optional expiry date for the token.
# Choose the desired scopes.
# Click the Create personal access token button.
# Save the personal access token somewhere safe. If you navigate away or refresh your page, and you did not save the token, you must create a new one.