Vulnerability-Lookup

CNVD-2016-11089

Vulnerability from cnvd - Published: 2016-11-15

Title

GitLab目录遍历漏洞

Description

GitLab是一套利用Ruby on Rails开发的开源应用程序，可实现一个自托管的Git（版本控制系统）项目仓库。 GitLab存在目录遍历漏洞，由于程序未能正确检查用户提供文档中的符号链接。攻击者可利用该漏洞检索任意文件的内容。

Severity

中

Patch Name

GitLab目录遍历漏洞的补丁

Patch Description

GitLab是一套利用Ruby on Rails开发的开源应用程序，可实现一个自托管的Git（版本控制系统）项目仓库。 GitLab存在目录遍历漏洞，由于程序未能正确检查用户提供文档中的符号链接。攻击者可利用该漏洞检索任意文件的内容。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/

Reference

http://www.securityfocus.com/bid/94136

Impacted products

Name
['GitLab GitLab >=8.13.0，<=8.13.2', 'GitLab GitLab >=8.12.0，<=8.12.7', 'GitLab GitLab >=8.11.0，<=8.11.9', 'GitLab GitLab >=8.10.0，<=8.10.12', 'GitLab GitLab >=8.9.0，<=8.9.11']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "94136"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-9086"
    }
  },
  "description": "GitLab\u662f\u4e00\u5957\u5229\u7528Ruby on Rails\u5f00\u53d1\u7684\u5f00\u6e90\u5e94\u7528\u7a0b\u5e8f\uff0c\u53ef\u5b9e\u73b0\u4e00\u4e2a\u81ea\u6258\u7ba1\u7684Git\uff08\u7248\u672c\u63a7\u5236\u7cfb\u7edf\uff09\u9879\u76ee\u4ed3\u5e93\u3002\r\n\r\nGitLab\u5b58\u5728\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\uff0c\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u68c0\u67e5\u7528\u6237\u63d0\u4f9b\u6587\u6863\u4e2d\u7684\u7b26\u53f7\u94fe\u63a5\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u68c0\u7d22\u4efb\u610f\u6587\u4ef6\u7684\u5185\u5bb9\u3002",
  "discovererName": "GitLab",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a \r\nhttps://about.gitlab.com/2016/11/02/cve-2016-9086-patches/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-11089",
  "openTime": "2016-11-15",
  "patchDescription": "GitLab\u662f\u4e00\u5957\u5229\u7528Ruby on Rails\u5f00\u53d1\u7684\u5f00\u6e90\u5e94\u7528\u7a0b\u5e8f\uff0c\u53ef\u5b9e\u73b0\u4e00\u4e2a\u81ea\u6258\u7ba1\u7684Git\uff08\u7248\u672c\u63a7\u5236\u7cfb\u7edf\uff09\u9879\u76ee\u4ed3\u5e93\u3002\r\n\r\nGitLab\u5b58\u5728\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\uff0c\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u68c0\u67e5\u7528\u6237\u63d0\u4f9b\u6587\u6863\u4e2d\u7684\u7b26\u53f7\u94fe\u63a5\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u68c0\u7d22\u4efb\u610f\u6587\u4ef6\u7684\u5185\u5bb9\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "GitLab\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "GitLab GitLab \u003e=8.13.0\uff0c\u003c=8.13.2",
      "GitLab GitLab \u003e=8.12.0\uff0c\u003c=8.12.7",
      "GitLab GitLab \u003e=8.11.0\uff0c\u003c=8.11.9",
      "GitLab GitLab \u003e=8.10.0\uff0c\u003c=8.10.12",
      "GitLab GitLab \u003e=8.9.0\uff0c\u003c=8.9.11"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/94136",
  "serverity": "\u4e2d",
  "submitTime": "2016-11-09",
  "title": "GitLab\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e"
}

CVE-2016-9086 (GCVE-0-2016-9086)

Vulnerability from cvelistv5 – Published: 2016-11-03 10:00 – Updated: 2024-08-06 02:42

Summary

GitLab versions 8.9.x and above contain a critical security flaw in the "import/export project" feature of GitLab. Added in GitLab 8.9, this feature allows a user to export and then re-import their projects as tape archive files (tar). All GitLab versions prior to 8.13.0 restricted this feature to administrators only. Starting with version 8.13.0 this feature was made available to all users. This feature did not properly check for symbolic links in user-provided archives and therefore it was possible for an authenticated user to retrieve the contents of any file accessible to the GitLab service account. This included sensitive files such as those that contain secret tokens used by the GitLab service to authenticate users. GitLab CE and EE versions 8.13.0 through 8.13.2, 8.12.0 through 8.12.7, 8.11.0 through 8.11.10, 8.10.0 through 8.10.12, and 8.9.0 through 8.9.11 are affected.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

2 references

URL	Tags
https://about.gitlab.com/2016/11/02/cve-2016-9086…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/94136	vdb-entryx_refsource_BID

Date Public

2016-11-03 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:42:10.527Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/"
          },
          {
            "name": "94136",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94136"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-11-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "GitLab versions 8.9.x and above contain a critical security flaw in the \"import/export project\" feature of GitLab. Added in GitLab 8.9, this feature allows a user to export and then re-import their projects as tape archive files (tar). All GitLab versions prior to 8.13.0 restricted this feature to administrators only. Starting with version 8.13.0 this feature was made available to all users. This feature did not properly check for symbolic links in user-provided archives and therefore it was possible for an authenticated user to retrieve the contents of any file accessible to the GitLab service account. This included sensitive files such as those that contain secret tokens used by the GitLab service to authenticate users. GitLab CE and EE versions 8.13.0 through 8.13.2, 8.12.0 through 8.12.7, 8.11.0 through 8.11.10, 8.10.0 through 8.10.12, and 8.9.0 through 8.9.11 are affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/"
        },
        {
          "name": "94136",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94136"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-9086",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "GitLab versions 8.9.x and above contain a critical security flaw in the \"import/export project\" feature of GitLab. Added in GitLab 8.9, this feature allows a user to export and then re-import their projects as tape archive files (tar). All GitLab versions prior to 8.13.0 restricted this feature to administrators only. Starting with version 8.13.0 this feature was made available to all users. This feature did not properly check for symbolic links in user-provided archives and therefore it was possible for an authenticated user to retrieve the contents of any file accessible to the GitLab service account. This included sensitive files such as those that contain secret tokens used by the GitLab service to authenticate users. GitLab CE and EE versions 8.13.0 through 8.13.2, 8.12.0 through 8.12.7, 8.11.0 through 8.11.10, 8.10.0 through 8.10.12, and 8.9.0 through 8.9.11 are affected."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/",
              "refsource": "CONFIRM",
              "url": "https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/"
            },
            {
              "name": "94136",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94136"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-9086",
    "datePublished": "2016-11-03T10:00:00.000Z",
    "dateReserved": "2016-10-27T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:42:10.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2016-11089

CVE-2016-9086 (GCVE-0-2016-9086)

Tags

Sightings

Nomenclature

Related by attack behaviour