CVE-2022-2185: GitLab Server

Summary

• An RCE was discovered in GitLab server and assigned CVE-2022-2185
• Exploit requires a valid account, but the default behavior of the server allows for new account creation with approval by the administrator.
• Censys users can find GitLab servers with the following Censys Search query
• Check out our GitLab Dashboard, which is updated every 24 hours.

Introduction

On July 1st, 2022, CVE-2022-2185, a critical issue in the GitLab server, was made public, allowing an authenticated user to craft a request that results in remote code execution (RCE). The following versions of GitLab are affected:

• 14.0 (fixed in v14.10.5)
• 15.0 (fixed in v15.0.4)
• 15.1 (fixed in v15.1.1)

It is important to understand that for this exploit to be successful, an attacker must have a valid login to the GitLab service. The default service allows users to sign up and create an account using their credentials. Additionally, an admin must explicitly disable the “Require admin approval for new sign-ups” setting for the user to obtain an account without approval from an administrator first.

While it may sound implausible that an attacker could trick an administrator into approving such a request, it is feasible. A remote user can still leverage the attack on systems where the credentials have been cracked, stolen, leaked, or obtained legally. A user can obtain shell-level access to the underlying host running the GitLab service if the attack is successful, allowing more permissive movement inside victim resources.

Identifying GitLab Instances

Using the same methods to identify GitLab versions for CVE-2021-22205, we determined that certain filenames found in the HTTP response body could be associated with specific versions of GitLab Server. In short, whenever a new build is tagged, along with many other events, GitLab’s Continuous Integration (CI) system will kick off a job that compiles static assets. This job results in some files having a unique file extension that can loosely map the running software to the original version.

For example, the file “public/assets/application.css” seems to have a uniquely generated filename for every minor release of the software, which includes a 64-byte ASCII-HEX encoded string appended to the end of the filename.

In our analysis of this specific vulnerability, we have found the following filenames in the HTTP response body that can map to a particular major and minor version of GitLab Server:

There are some overlaps in what we can identify and what is and is not vulnerable; for example, the file associated with v14.10.1 (a vulnerable version of GitLab) and v.14.10.5 (the fixed version) have the same filename. This overlap is also the case for v15.0.2 and v15.0.3, which have the same filename as the fixed version v15.0.4. And finally, version 15.1.0 has the same filename as the fixed version (v15.1.1).

At the time of writing (July 24th, 2022), Censys has observed 17,828 hosts with an associated version that may be vulnerable to this attack (excluding v14.10 hosts due to the version overlap). Of those hosts, only 6,759 have new account creation enabled. Unfortunately, Censys cannot validate whether these hosts require admin approval for new sign-ups. Still, given that this setting is the default, there is a high likelihood that approval is required.

Geographically, most hosts running a matching version of GitLab with account creation enabled are in China, with 3,646 hosts. The United States is trailing with 452 hosts, closely followed by South Korea with only 447 hosts.

To help the general community monitor these vulnerabilities, Censys has created a public GitLab-specific interactive dashboard tracking both CVE-2022-2185 and CVE-2021-22205, updated every 24 hours. With this, users can filter various fields related to GitLab (including whether to display statistics on GitLab servers with open account creation). Censys will add new features and statistics in the upcoming days.

Vulnerability Details

For more details about the actual vulnerability, a researcher at Star Labs has written a very extensive analysis of this particular bug which references some of the original work done by a bounty hunter named Vakzz on Hackerone.

What do I do about it?

• Upgrade to GitLab v14.10.5, v15.0.4, or v15.1.1.
• Censys ASM customers now have access to a new risk that identifies potentially vulnerable GitLab services.
• At the very least, an administrator should disable the new account creation feature under the administration UI -> Settings -> General -> “Sign-up restrictions” and unselect the option “Sign-up enabled.”