Don't make random HTTP requests.

Summary

This video demonstrates exploiting a Server-Side Request Forgery (SSRF) vulnerability in GitLab, allowing an attacker to execute arbitrary commands on an internal Redis service. The presenter explains the concept of SSRF, walks through setting up GitLab using Docker, and details the exploit process via the repository mirroring feature. By leveraging CRLF injection, the attacker sends crafted commands to Redis, ultimately achieving remote code execution. This engaging overview not only illustrates the technical aspects of the exploit but also highlights the importance of securing web applications against such vulnerabilities.

Takeaways

• 😀 SSRF (Server Side Request Forgery) allows a server to make arbitrary requests, potentially leading to serious vulnerabilities.
• 😀 GitLab, an open-source software development platform, can be exploited using SSRF to access internal services like Redis.
• 😀 A common mitigation for SSRF vulnerabilities is checking requests against localhost, but these checks can often be bypassed.
• 😀 The git protocol can be exploited to send crafted payloads to internal services, leading to command execution on Redis.
• 😀 CRLF (Carriage Return Line Feed) injection can be used to exploit SSRF vulnerabilities by smuggling multiple commands.
• 😀 By leveraging Redis as a job queue, attackers can inject malicious jobs that execute arbitrary Ruby code.
• 😀 The 'perform' method in Ruby worker classes can be abused to execute potentially harmful commands.
• 😀 A specific gadget found in GitLab's code allows the use of the `_send` method to execute functions dynamically.
• 😀 Successful exploitation requires careful crafting of a URL that includes encoded commands for Redis.
• 😀 Understanding the internal architecture and services of applications like GitLab is crucial for identifying and exploiting vulnerabilities.

Q & A

What is SSRF and how does it work?

Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make a server send arbitrary requests to other services, potentially exposing internal systems.

Why is SSRF considered a security issue?

SSRF can lead to unauthorized access to internal services that are not exposed to the internet, allowing attackers to exploit these services for further attacks.

What role does GitLab play in this vulnerability demonstration?

GitLab serves as the target application in this demonstration, showcasing how SSRF can be exploited through its repository mirroring feature.

How can an attacker exploit SSRF in GitLab?

An attacker can exploit SSRF by providing a malicious URL that targets internal services, such as Redis, through the repository mirroring feature.

What is the significance of Redis in this exploit?

Redis is used in GitLab for job processing, and exploiting SSRF allows an attacker to send commands to Redis, potentially leading to code execution.

What is CRLF injection and how is it used here?

CRLF injection involves injecting carriage return and line feed characters to manipulate how requests are processed. In this case, it allows the attacker to send multiple commands to Redis.

What is the Git protocol's role in this exploit?

The Git protocol is used to send crafted requests to Redis, where the attacker can embed commands in the request path, leveraging SSRF to gain control over the internal service.

What steps did the presenter take to set up the GitLab environment?

The presenter set up GitLab using Docker, specifying a Docker Compose file to configure the necessary services and dependencies.

How does the exploit lead to code execution in GitLab?

By successfully sending crafted commands to Redis through SSRF, the attacker can enqueue malicious jobs that execute arbitrary code when processed by the Ruby interpreter.

What preventative measures are usually taken against SSRF vulnerabilities?

Developers often implement checks, such as blocking requests to localhost or internal IP addresses, but these can be bypassed if URL parsing is not handled correctly.