Published: 17/05/2019 Updated: 24/12/2020

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 447

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

GitLab CE/EE versions 8.18 up to 11.x prior to 11.3.11, 11.4.x prior to 11.4.8, and 11.5.x prior to 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gitlab gitlab

GitLab version 1147 authenticated remote code execution exploit ...

GitLab version 1147 authenticated remote code execution exploit Original discovery of this issue attributed to Mohin Paramasivam in December of 2020 ...

RCE for old gitlab version <= 11.4.7 & 12.4.0-12.8.1 and LFI for old gitlab versions 10.4 - 12.8.1

Gitlab RCE - Remote Code Execution RCE for old gitlab version <= 1147 & 1240-1281 LFI for old gitlab versions 104 - 1281 This is an exploit for old Gitlab versions This shouldnt work in the wild but it still seems to be popular in CTFs Educational use only Illegal things are illegal CVEs: CVE-2018-19571 (SSRF) + CVE-2018-19585 (CRLF) & CVE-20

GitLab 11.4.7 RCE exploit with different reverse shells. CVE-2018-19571 + CVE-2018-19585

gitlab-RCE-1147 GitLab 1147 CE RCE exploit with different reverse shells CVE-2018-19571: nvdnistgov/vuln/detail/CVE-2018-19571 CVE-2018-19585: nvdnistgov/vuln/detail/CVE-2018-19585 Modification of the version from Sam Redmond and Tam Lai Yin in order to learn and practice How to use It is written in python3 as all things should be Dependencies: pip3 i

Gitlab RCE - Remote Code Execution CVEs: CVE-2018-19571 (SSRF) + CVE-2018-19585 (CRLF) & CVE-2020-10977 Remote code execution against GitLab Community Edition (CE) and Enterprise Edition (EE) It combines an arbitrary file read to extract the Rails secret_key_base, and gains remote code execution with a deserialization vulnerability of a signed experimentation_subject_

RCE for old gitlab version <= 11.4.7 & 12.4.0-12.8.1 and LFI for old gitlab versions 10.4 - 12.8.1

Gitlab RCE - Remote Code Execution RCE for old gitlab version <= 1147 & 1240-1281 LFI for old gitlab versions 104 - 1281 This is an exploit for old Gitlab versions This shouldnt work in the wild but it still seems to be popular in CTFs Educational use only Illegal things are illegal CVEs: CVE-2018-19571 (SSRF) + CVE-2018-19585 (CRLF) & CVE-20

Fixed version of the Python script to exploit CVE-2018-19571 and CVE-2018-19585 (GitLab 11.4.7 - Authenticated Remote Code Execution) that is available at https://www.exploit-db.com/exploits/49263 (Python 3.9).

edb-49263-fixed - GitLab 1147 - Authenticated Remote Code Execution Fixed version of the Python script to exploit CVE-2018-19571 and CVE-2018-19585 (GitLab 1147 - Authenticated Remote Code Execution) that is available at wwwexploit-dbcom/exploits/49263 (Python 39) Usage Edit the script and replace the target address there with the actual target address Also kee

CWE-93 https://about.gitlab.com/blog/categories/releases/https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/http://packetstormsecurity.com/files/160516/GitLab-11.4.7-Remote-Code-Execution.html http://packetstormsecurity.com/files/160699/GitLab-11.4.7-Remote-Code-Execution.html https://nvd.nist.gov https://github.com/pyrat3/gitlab_RCE https://packetstormsecurity.com/files/160516/GitLab-11.4.7-Remote-Code-Execution.html

CVE-2018-19585

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect