Gitlab渗透的深入利用及知识点总结

一、版本探测

http://url/assets/webpack/manifest.json 
将该json与GitHub某个数据库比对
https://github.com/righel/gitlab-version-nse/blob/main/gitlab_hashes.json
获取对应的版本信息

二、常见漏洞

给一个大佬总结的很全的清单：
https://www.moonsec.com/7495.html
这里只列出2020年以后的CVE号和对应的影响版本：
CVE-2020-10977任意文件读取
8.5 <= GitLab GitLab CE/EE <=12.9

CVE-2021-2884远程命令执行
11.3.4 <= GitLab CE/EE < 15.1.5
15.2 <= GitLab CE/EE < 15.2.3
15.3 <= GitLab CE/EE < 15.3.1

CVE-2021-22205远程命令执行
11.9 <= Gitlab CE/EE < 13.8.8
13.9 <= Gitlab CE/EE < 13.9.6
13.10 <= Gitlab CE/EE < 13.10.3

CVE-2021-22214Gitlab API未授权SSRF
10.5<=Gitlab CE/EE<13.10.5
13.11<=Gitlab CE/EE<13.11.5 
13.12<=Gitlab CE/EE<13.12.2

CVE-2022-2992 import api 远程命令执行
11.10 <= GitLab CE/EE < 15.1.6
15.2 <= GitLab CE/EE < 15.2.4
15.3 <= GitLab CE/EE < 15.3.2

CVE-2023-7028
16.1 <=GitLab CE<16.1.6
16.2