Description
2022年8月30日，Gitlab 官方发布安全通告，披露 CVE-2022-2992 GitLab CE/EE import api 远程代码执行漏洞。攻击者在登录后具有import权限的情况下可构造恶意请求执行任意代码，控制服务器。
GitLab CE/EE import api 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://avd.aliyun.com/detail?id=AVD-2022-2992
https://www.secrss.com/articles/46433
https://zhuanlan.zhihu.com/p/559198643
https://nic.yangtzeu.edu.cn/info/1012/1190.htm
https://www.qianxin.com/news/detail?news_id=2569
https://cloud.tencent.com/developer/article/2254503
https://juejin.cn/post/7135286243427876894
https://blog.csdn.net/cups107/article/details/126501687
https://github.com/ZZ-SOCMAP/CVE-2021-22205
https://zone.ci/aliyun/ali_highrisk/11100.html
https://www.exploit-db.com/exploits/51181
https://nvd.nist.gov/vuln/detail/cve-2022-2992
https://medium.com/@Aacle/%EF%B8%8F-remote-code-execution-in-gitlab-the-tale-of-a-rogue-github-import-660ec866f07c
https://securityaffairs.com/134769/security/gitlab-rce-bug.html
https://www.helpnetsecurity.com/2022/08/24/cve-2022-2884/
https://gitlab.com/gitlab-org/gitlab/-/issues/371884
https://about.gitlab.com/releases/2022/08/22/critical-security-release-gitlab-15-3-1-released