CVE-2021-22210 PoC — GitLab 输入验证错误漏洞

Source

https://github.com/Jeromeyoung/CVE-2021-22210

Associated Vulnerability

Title:GitLab 输入验证错误漏洞 (CVE-2021-22210)
Description:GitLab是美国GitLab公司的一款使用Ruby on Rails开发的、自托管的、Git（版本控制系统）项目仓库应用程序。该程序可用于查阅项目的文件内容、提交历史、Bug列表等。 GitLab CE/EE 13.2 版本及之后版本存在输入验证错误漏洞，该漏洞源于通过API查询存储库分支时，GitLab是忽略查询参数并返回大量结果。

Description

CVE-2021-22205未授权漏洞批量检测

Readme

## 0x01 前言

**声明:本项目仅供学习和交流使用，请勿用于非法未授权测试！**

**更新记录**

10.30

- 增加了`burp`代理池

- 重写了命令行参数
- 增加了`gitlab`未授权批量以及单个检测功能

## 0x02 使用说明

安装

```bash
pip3 install - r requirements.txt
```

使用方法

```bash
usage: CVE-2021-22205.py [-h] [-w WAY] [-u URL] [-f FILE]

CVE-2021-22205

optional arguments:
  -h, --help            show this help message and exit
  -w WAY, --way WAY     Exploit way Forexample unauthorized or register new projects
  -u URL, --url URL     url like http://127.0.0.1:8080
  -f FILE, --file FILE  url file path
```

单个`url`进行未授权上传检测
```python
python3 CVE-2021-22205.py -w un -u http://127.0.0.1
```

进行批量未授权上传检测

```python
python3 CVE-2021-22205.py -w un -f ./url.txt
```

举个小列子

此漏洞默认不回显，输入命令，例如以`dnslog`带数据进行判断

![](img/img1.png)

重回`dnslog`进行检测，有回显即成功

![](img/img2.png)

## REF

https://hackerone.com/reports/1154542

https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/

https://github.com/RedTeamWing/CVE-2021-22205

https://github.com/mr-r3bot/Gitlab-CVE-2021-22205/

File Snapshot


 [4.0K]  /data/pocs/46d38617b40ba4004f33c930b194ed109c107caa
├── [3.7K]  CVE-2021-22205.py
├── [4.0K]  img
│   ├── [ 88K]  img1.png
│   └── [157K]  img2.png
├── [1.3K]  README.md
└── [  40]  requirements.txt

1 directory, 5 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!