GitLab CVE-2024-43666 Arbitrary File Read Vulnerability Analysis and POC

Vulnerability Summary: CVE-2024-43666 (GitLab Arbitrary File Read Vulnerability) Vulnerability Overview GitLab contains an Arbitrary File Read vulnerability. This vulnerability allows an attacker to read the contents of arbitrary files on the server by sending a specially crafted HTTP request to the endpoint in GitLab. Vulnerability Type: Arbitrary File Read Trigger Condition: The attacker must know the ID of the target project and construct a parameter containing specific paths (e.g., ). Root Cause: GitLab fails to properly filter or escape path traversal characters (such as ) when processing the parameter, allowing access to files outside the project repository directory. Scope of Impact Affected Versions: GitLab versions 16.0.0 through 16.4.0. Fixed Versions: This vulnerability has been fixed in GitLab version 16.4.1 and later. Affected Components: GitLab API endpoints, specifically those related to repository tree queries. Remediation 1. Upgrade Version: Upgrade GitLab to version 16.4.1 or higher. This is the officially recommended fix. 2. Temporary Mitigation Measures: If an immediate upgrade is not possible, configure the Web server (e.g., Nginx, Apache) or reverse proxy to intercept requests containing in the parameter. Restrict access to the endpoint, allowing access only to trusted users or IP addresses. POC Code The following Python script is used to verify this vulnerability by attempting to read the file on the GitLab server: Important Notice: This code is intended solely for authorized security testing and vulnerability verification. Scanning or attacking systems without authorization is illegal. In actual environments, the number of in the parameter may need to be adjusted depending on the directory structure of the GitLab project. If the project is private, a valid must be provided to access the API.

Goal Reached Thanks to every supporter — we hit 100%!

GitLab CVE-2024-43666 Arbitrary File Read Vulnerability Analysis and POC

More from this source