3 ms·
As the exploit requires uploading a file, is it required for the attacker to first have a user account with file upload permissions?
by Eduard 5y ago
As the exploit requires uploading a file, is it required for the attacker to first have a user account with file upload permissions?
- nielsole 5y agoAnyone who can open issues in a repo I think
- mattbee 5y agoI am confused by this right now. I built a self-hosted gitlab install years ago for my own use, turned off sign-up, no public project listings - and still it was compromised. The HackerOne PoC URL throws a sign-in redirect for me, so I'm still trying to work it out.
- cjbprime 5y agoIt was originally incorrectly thought to require authentication, but actually doesn't.
- ceochronos 5y agoSame thing happened with my self-hosted gitlab. Besides I got a new user (gitlab) with admin privileges and somehow installed a miner script running under git user (system).
- cjbprime 5y agoNo. The original submission described the vulnerability as requiring an authenticated user, but it was later discovered (recently) that it works unauthenticated too, and that's what kicked off this mass exploitation. No user account is required.