Authenticated RCE in GitLab GitHub Import API

This repository contains a single Metasploit module implementing a weaponized exploit for CVE-2022-2992, a critical authenticated remote code execution (RCE) vulnerability in GitLab Community and Enterprise Editions. The exploit targets the GitHub repository import feature in vulnerable GitLab versions (11.10-15.1.6, 15.2-15.2.4, 15.3-15.3.2). By acting as a malicious GitHub server, the attacker delivers a crafted Redis serialization protocol object in the 'default_branch' field of the import process. When GitLab deserializes this object, arbitrary commands are executed on the server. The module requires valid GitLab credentials and network access to the target. The default payload is a reverse bash shell, but any Metasploit unix command payload can be used. The module simulates several GitHub and Git endpoints to facilitate the import and payload delivery. The code is mature, operational, and part of the Metasploit framework, making it easily customizable and reliable for attackers.

This repository provides a working exploit for CVE-2022-2992, an authenticated remote code execution vulnerability in GitLab CE/EE via the 'Import from GitHub' API endpoint. The exploit targets GitLab versions 11.10 before 15.1.6, 15.2 before 15.2.4, and 15.3 before 15.3.2. The structure includes: - 'exploit.py': The main exploit script, which automates group creation, runs a local Flask server (server.py), and triggers the vulnerable GitLab import endpoint to execute a malicious payload. - 'payload_gen.rb': Generates a Ruby Marshal serialized payload that, when deserialized by the target, executes arbitrary system commands (e.g., a reverse shell). - 'server.py': Implements a Flask server that mimics a GitHub repository and serves the payload to the target during the import process. - 'data/build.sh', 'data/healthy.sh', and 'data/docker-compose.yml': Scripts and configuration to set up a local vulnerable GitLab instance for testing. The exploit requires an authenticated GitLab user with a personal access token and a reachable attacker-controlled server (e.g., via ngrok). The attacker generates a payload, configures the server, and runs the exploit script, which results in remote code execution on the target GitLab server. The exploit is operational and demonstrates a full attack chain, including payload generation, delivery, and execution.

This repository provides a working exploit for CVE-2022-2992, an authenticated remote command execution vulnerability in GitLab CE/EE (versions 11.10 before 15.1.6, 15.2 before 15.2.4, 15.3 before 15.3.2). The exploit chain involves generating a malicious serialized Ruby payload (payload_gen.rb), hosting it on a Flask server (server.py) accessible via a public URL (e.g., ngrok), and using exploit.py to automate the attack steps. The exploit requires a valid GitLab user account and personal access token. The attacker sets up a group on the target GitLab instance, tricks the GitLab import API into deserializing the malicious payload, and triggers remote code execution, typically resulting in a reverse shell to the attacker's server. The repository also includes scripts and configuration files (data/build.sh, data/docker-compose.yml, data/healthy.sh) to help set up a vulnerable GitLab environment for testing. The main exploit logic is in exploit.py, with payload generation in payload_gen.rb and the attacker's server logic in server.py. The exploit is operational and provides a shell on the target if successful.