gitlab-uninitialized-password: Uninitialized GitLab instances

日期: 2025-09-01 | 影响软件: gitlab | POC: 已公开

漏洞描述

Prior to version 14, GitLab installations required a root password to be set via the web UI. If the administrator skipped this step, any visitor could set a password and control the instance.

PoC代码[已公开]

id: gitlab-uninitialized-password

info:
  name: Uninitialized GitLab instances
  author: GitLab Red Team
  severity: high
  description: |
    Prior to version 14, GitLab installations required a root password to be
    set via the web UI. If the administrator skipped this step, any visitor
    could set a password and control the instance.
  reference:
    - https://gitlab.com/gitlab-org/gitlab/-/issues/211328
    - https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/5331
    - https://docs.gitlab.com/omnibus/installation/#set-up-the-initial-password

rules:
  r0:
    request:
      method: GET
      path: /users/sign_in
      follow_redirects: true
    expression: response.status == 200 && response.body.bcontains(b'Change your password') && response.body.bcontains(b'New password') && response.body.bcontains(b'Confirm new password') response.raw_header.bcontains(b'gitlab_session')
expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/gitlab-uninitialized-password.yaml

相关漏洞推荐