0x01 Preface

Disclaimer: This project is for learning and communication purposes only. Do not use it for illegal unauthorized testing!

Update Log

10.30

Added burp proxy pool
Rewrote command-line arguments
Added GitLab unauthorized batch and single detection functionality

0x02 Usage Instructions

Installation

pip3 install - r requirements.txt

Usage

usage: CVE-2021-22205.py [-h] [-w WAY] [-u URL] [-f FILE]

CVE-2021-22205

optional arguments:
  -h, --help            show this help message and exit
  -w WAY, --way WAY     Exploit way Forexample unauthorized or register new projects
  -u URL, --url URL     url like http://127.0.0.1:8080
  -f FILE, --file FILE  url file path

Single url for unauthorized upload detection

python3 CVE-2021-22205.py -w un -u http://127.0.0.1

Batch unauthorized upload detection

python3 CVE-2021-22205.py -w un -f ./url.txt

A small example

This vulnerability does not echo back by default. Enter a command, for example using dnslog to carry data for verification

Return to dnslog to check; if there is a response, it is successful

References

https://hackerone.com/reports/1154542

https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/

https://github.com/RedTeamWing/CVE-2021-22205

https://github.com/mr-r3bot/Gitlab-CVE-2021-22205/

CVE-2021-22210

Most Popular