Description
GitLab 是一个用于仓库管理系统的开源项目，使用Git作为代码管理工具，并在此基础上搭建起来的Web服务。 GitLab CE/EE存在一个漏洞，该漏洞允许攻击者访问受害者的个人访问令牌 (PAT) 来升级权限，严重可导致敏感信息泄露和服务器失陷。
目前受影响的GitLab版本：
8.12 ≤ GitLab CE/EE< 17.4.5
17.5 ≤ GitLab CE/EE< 17.5.3
17.6 ≤ GitLab CE/EE< 17.6.1
GitLab 权限提升漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://zhi.oscs1024.com/42178.html
https://wlaq.njupt.edu.cn/2024/1202/c14800a275312/page.htm
http://www.cstu.edu.cn/xxh/info/1221/1701.htm
https://wlaq.dlut.edu.cn/info/1095/5534.htm
https://www.secevery.com/toBugInfo?id=1866360939513430017
https://cn-sec.com/archives/3469970.html
https://www.sangfor.com/farsight-labs-threat-intelligence/cybersecurity/cve-2024-8114-gitlab-privilege-escalation
https://gitlab.com/gitlab-org/gitlab/-/issues/555786
https://www.tenable.com/plugins/nessus/191648
https://hossted.com/knowledge-base/newsflash/devops/developer-tools/gitlab-privilege-escalation-via-personal-access-token-pat/
https://nvd.nist.gov/vuln/detail/CVE-2024-8114