{"uuid": "1c488aa5-28a8-4b84-aa4c-be35290f50b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-2884", "type": "seen", "source": "https://t.me/hacking_Attack/72909", "content": "Black Hat Ethical Hacking\nGitLab patches RCE bug in GitHub import function\n\nGitLab patches RCE bug in GitHub import functionPost Views: 17 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A vulnerability in GitLab allowed attackers to stage various attacks against GitLab servers, including the cloud-hosted GitLab.com platform.The bug, reported by security researcher \u2018yvvdwf\u2019, was caused by the way GitLab imports data from GitHub, which could be exploited to run commands on the host server. Unsafe importsGitLab uses Octokit, a library that provides an interface to import data from the GitHub API. To retrieve and present its results, Octokit uses the HTTP client library Sawyer.\n\nHowever, GitLab directly used the Sawyer results returned by Octokit without sanitizing them, which provided opportunities to insert malicious commands.\n\nYvvdwf found that one of the parameters used in the import function was prone to command injections against GitLab\u2019s Redis database.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course RCE, information theft, and moreOn standalone GitLab installations, an attacker could exploit the command injection\u00a0bug to escalate from Redis to Bash and send commands to the operating system. Any potential attacker would have remote code execution (RCE) access to the host with the privileges of the host process.\n\nWhile the RCE\u00a0exploit did not work on GitLab.com, yvvdwf was able to use other Redis commands to replicate data from GitLab.com to a standalone server with a public IP. They were also able to poison GitLab projects through the same mechanism and make them inaccessible.\n\nAn attacker with a standalone GitLab installation and an API access token could use the exploit to steal information, inject malicious code, and perform other malicious actions against GitLab.com.\nTrending: A primer on OS Command Injection Attacks\nTrending: OSINT Tool: ProtOSINT Protecting GitLab serversThe vulnerability was assigned CVE-2022-2884\u00a0with a critical base score of 9.9 in the Common Vulnerability Scoring System.\n\nGitLab has already patched the issue in GitLab.com and published a critical security release\u00a0for GitLab Community Edition and Enterprise Edition.\n\nAll users are advised to upgrade their GitLab installation. For organizations that can\u2019t upgrade right away, GitLab advises them to secure their installation by disabling imports until they can patch their system.\n\nWhile GitLab users will be safe by using the cloud or updated self-hosted version of the platform, other services that use Octakit to interact with GitHub\u00a0should be wary and make sure that they perform the right checks around the data they pass on and receive through the library.\n\n\u200b\nTrending: Microsoft SQL servers hacked with FARGO ransomware attacks Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-5-300x150.png New npm timing attack could lead to supply chain attacksOctober 13, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-4-300x150.png Critical RCE Vulnerability Found in vm2 Sandbox LibraryOctober 12, 2022[...]", "creation_timestamp": "2026-09-02T01:01:35.290679Z"}