CVE-2020-10977

Description

GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	gitlab	No fix yet	—

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

GitLab File Read Remote Code Execution
exploit/multi/http/gitlab_file_read_rce

GitHub 8 repositories

thewhiteh4t/cve-2020-10977 ★ 69 · Nov 20, 2020

GitLab 12.9.0 Arbitrary File Read
KooroshRZ/CVE-2020-10977 ★ 4 · May 2, 2020

Exploit for "GitLab Instance" Arbitrary server file read vulnerability
vandycknick/gitlab-cve-2020-10977 ★ 2 · May 2, 2021

GitLab Arbitrary File Read Exploit
liath/CVE-2020-10977 ★ 2 · Mar 7, 2021

Gitlab v12.4.0-8.1 RCE
lisp3r/cve-2020-10977-read-and-execute ★ 1 · Apr 11, 2021

cve-2020-10977 read and execute
possib1e/cve-2020-10977 ★ 0 · Feb 26, 2021

GitLab 12.9 Arbitrary File Read
erk3/gitlab-12.9.0-file-read ★ 0 · Jan 29, 2021

A (wanted to be) better script than what can be found on exploit-db about the authenticated arbitrary read file on GitLab v12.9.0 (CVE-2020-10977)
JustMichi/CVE-2020-10977.py ★ 0 · Nov 25, 2020

authenticated arbitrary file read for Gitlab (CVE-2020-10977)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.