GitLab 16.0-16.8.1 Path Traversal & Arbitrary File Write via Workspace
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-0402. PoCs published by doyensec.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-0402, leveraging a malicious Devfile Registry to perform arbitrary file writes on GitLab instances via path traversal in the registry-support library. The exploit overwrites the SSH authorized_keys file to achieve remote code execution as the 'git' user.
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace.
Exploits (1)
This repository contains a functional exploit for CVE-2024-0402, leveraging a malicious Devfile Registry to perform arbitrary file writes on GitLab instances via path traversal in the registry-support library. The exploit overwrites the SSH authorized_keys file to achieve remote code execution as the 'git' user.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H