Ò»¡¢Îó²î¸ÅÊö
Îó²îÃû³Æ | GitLab Webhook SSRFÎó²î |
CVE ID | CVE-2025-6454 |
Îó²îÀàÐÍ | ·þÎñ¶ËÇëÇóαÔì | ·¢Ã÷ʱ¼ä | 2025-09-12 |
Îó²îÆÀ·Ö | 8.5 | Îó²îÆ·¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | µÍ |
ʹÓÃÄÑ¶È | ¸ß | Óû§½»»¥ | ²»ÐèÒª |
PoC/EXP | δ¹ûÕæ | ÔÚҰʹÓà | δ·¢Ã÷ |
GitLabÊÇÒ»¸ö»ùÓÚWebµÄDevOpsƽ̨£¬Ìṩ´Ó´úÂëÍйܡ¢°æ±¾¿ØÖÆ¡¢Ò»Á¬¼¯³ÉÓëÒ»Á¬½»¸¶£¨CI/CD£©¡¢´úÂëÉó²éµ½Çå¾²¼ì²âÓëÔËά¼à¿ØµÄÍêÕû¹¤¾ßÁ´¡£ËüÖ§³ÖGit¿ÍÕ»ÖÎÀí£¬×ÊÖú¿ª·¢ÍŶÓʵÏÖѸËÙ¿ª·¢ÓëÐͬÊÂÇ飬ÆÕ±éÓ¦ÓÃÓÚÆóÒµ¼¶Èí¼þ¿ª·¢Óë½»¸¶³¡¾°¡£GitLab·ÖΪÉçÇø°æ£¨CE£©ºÍÆóÒµ°æ£¨EE£©£¬ÁýÕÖ´Ó¿ªÔ´µ½ÉÌÒµ»¯µÄ¶àÌõÀíÐèÇó¡£
2025Äê9ÔÂ12ÈÕ£¬×ðÁú¿Ê±¼¯ÍÅVSRC¼à²âµ½GitLab¹Ù·½ÐÞ¸´ÁËÒ»¸ö±£´æÓÚWebhook×Ô½ç˵ÇëÇóÍ·´¦Öóͷ£Âß¼ÖеķþÎñ¶ËÇëÇóαÔ죨SSRF£©Îó²î£¨CVE-2025-6454£©¡£¸ÃÎó²îÔÊÐí¾ÓÉÉí·ÝÑéÖ¤µÄÓû§ÔÚÊðÀíÇéÐÎÏÂͨ¹ý½á¹¹Ìض¨ÇëÇóÍ·ÐòÁУ¬ÈƹýУÑé»úÖÆ²¢ÏòÄÚ²¿ÏµÍ³Ìᳫ·ÇÔ¤ÆÚÇëÇó¡£Ò»µ©±»Ê¹Ó㬹¥»÷Õß¿ÉÄÜÔÚÒ»¶¨Ìõ¼þÏ»á¼ûÃô¸ÐÄÚ²¿·þÎñ»ò½øÒ»²½Ìᳫ¹¥»÷£¬¶ÔϵͳµÄÍêÕûÐÔÓëÇå¾²×é³ÉÑÏÖØÍþв¡£Îó²îÆÀ·Ö8.5·Ö£¬Îó²î¼¶±ð¸ßΣ¡£
¶þ¡¢Ó°Ïì¹æÄ£
16.11.0 <= GitLab < 18.1.618.2.0 <= GitLab < 18.2.618.3.0 <= GitLab < 18.3.2
Èý¡¢Çå¾²²½·¥
3.1 Éý¼¶°æ±¾
ÒÑÐû²¼ÐÞ¸´°æ±¾£¬Ç뽫GitLabÉý¼¶µ½Èçϰ汾¡£
ÏÂÔØÁ´½Ó£ºhttps://about.gitlab.com/update/
3.2 ÔÝʱ²½·¥
ÔÝÎÞ¡£
3.3 ͨÓý¨Òé
? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬ïÔÌϵͳÎó²î£¬ÌáÉý·þÎñÆ÷µÄÇå¾²ÐÔ¡£? ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬Ð޸ķÀ»ðǽսÂÔ£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻò·þÎñ£¬ïÔ̽«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬ïÔ̹¥»÷Ãæ¡£? ʹÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£? ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬ÆôÓöàÒòËØÈÏÖ¤»úÖÆºÍ×îСȨÏÞÔÔò£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏÞ¶È¡£? ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£
3.4 ²Î¿¼Á´½Ó
https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/https://www.cve.org/CVERecord?id=CVE-2025-6454/