module

GitLab File Read Remote Code Execution

Try Surface Command
Back to search
Disclosed
2020-03-26
Created
2020-12-10

Description

This module provides remote code execution against GitLab Community
Edition (CE) and Enterprise Edition (EE). It combines an arbitrary file
read to extract the Rails "secret_key_base", and gains remote code
execution with a deserialization vulnerability of a signed
'experimentation_subject_id' cookie that GitLab uses internally for A/B
testing.

Note that the arbitrary file read exists in GitLab EE/CE 8.5 and later,
and was fixed in 12.9.1, 12.8.8, and 12.7.8. However, the RCE only affects
versions 12.4.0 and above when the vulnerable `experimentation_subject_id`
cookie was introduced.

Tested on GitLab 12.8.1 and 12.4.0.

Authors

William Bowling (vakzz)
alanfoster

Platform

Ruby

Architectures

ruby

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/multi/http/gitlab_file_read_rce
    msf exploit(gitlab_file_read_rce) > show targets
        ...targets...
    msf exploit(gitlab_file_read_rce) > set TARGET < target-id >
    msf exploit(gitlab_file_read_rce) > show options
        ...show and set options...
    msf exploit(gitlab_file_read_rce) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today