EDB-49257

PoC

GitLab 11.4.7 - Remote Code Execution (Authenticated) (1)

view exploit source exploit_dbtype webappsauthor Fortunato Lodaripublished 2020-12-14catalog exploit_db

exploited CVEs (2)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2018-19571US	high7.7	32.1% (98th)	Exploit	2019-07-10
GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks.
CVE-2018-19585US	high7.5	14.5% (97th)	Exploit	2019-05-17
GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol.

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.