Rapid7 Vulnerability & Exploit Database

GitLab File Read Remote Code Execution

Back to Search

GitLab File Read Remote Code Execution

Disclosed
03/26/2020
Created
12/10/2020

Description

This module provides remote code execution against GitLab Community Edition (CE) and Enterprise Edition (EE). It combines an arbitrary file read to extract the Rails "secret_key_base", and gains remote code execution with a deserialization vulnerability of a signed 'experimentation_subject_id' cookie that GitLab uses internally for A/B testing. Note that the arbitrary file read exists in GitLab EE/CE 8.5 and later, and was fixed in 12.9.1, 12.8.8, and 12.7.8. However, the RCE only affects versions 12.4.0 and above when the vulnerable `experimentation_subject_id` cookie was introduced. Tested on GitLab 12.8.1 and 12.4.0.

Author(s)

  • William Bowling (vakzz)
  • alanfoster

Platform

Ruby

Architectures

ruby

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/multi/http/gitlab_file_read_rce
msf exploit(gitlab_file_read_rce) > show targets
    ...targets...
msf exploit(gitlab_file_read_rce) > set TARGET < target-id >
msf exploit(gitlab_file_read_rce) > show options
    ...show and set options...
msf exploit(gitlab_file_read_rce) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;