CVE-2022-2992 : A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.

A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.

Published 2022-10-17 16:15:22

Updated 2023-02-15 20:15:11

Source GitLab Inc.

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2022-2992

Gitlab » Gitlab » Community Edition
Versions from including (>=) 15.2 and before (<) 15.2.4
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions
Gitlab » Gitlab » Community Edition
Versions from including (>=) 15.3 and before (<) 15.3.2
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 15.3 and before (<) 15.3.2
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Community Edition
Versions from including (>=) 11.10 and before (<) 15.1.6
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 15.2 and before (<) 15.2.4
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 11.10 and before (<) 15.1.6
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-2992

EPSS FAQ

2.38%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 90 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2022-2992

GitLab GitHub Repo Import Deserialization RCE

Disclosure Date: 2022-10-06

First seen: 2023-09-11

exploit/multi/http/gitlab_github_import_rce_cve_2022_2992

An authenticated user can import a repository from GitHub into GitLab. If a user attempts to import a repo from an attacker-controlled server, the server will reply with a Redis serialization protocol object in the nested `default_branch`. GitLab will cache t

More information

CVSS scores for CVE-2022-2992

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.9	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	3.1	6.0	GitLab Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High
9.9	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	3.1	6.0	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-2992

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-2992

https://hackerone.com/reports/1679624

HackerOne
Permissions Required;Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2992.json

2022/CVE-2022-2992.json · master · GitLab.org / cves · GitLab
Third Party Advisory
http://packetstormsecurity.com/files/171008/GitLab-GitHub-Repo-Import-Deserialization-Remote-Code-Execution.html

GitLab GitHub Repo Import Deserialization Remote Code Execution ≈ Packet Storm
https://gitlab.com/gitlab-org/gitlab/-/issues/371884

Remote Command Execution via Github import (#371884) · Issues · GitLab.org / GitLab · GitLab
Broken Link;Third Party Advisory

Jump to