¡¾Îó²îͨ¸æ¡¿GitLab Webhook SSRFÎó²î (CVE-2025-6454)

Ðû²¼Ê±¼ä 2025-09-12

Ò»¡¢Îó²î¸ÅÊö


Îó²îÃû³Æ

GitLab Webhook SSRFÎó²î

CVE   ID

CVE-2025-6454

Îó²îÀàÐÍ

·þÎñ¶ËÇëÇóαÔì

·¢Ã÷ʱ¼ä

2025-09-12

Îó²îÆÀ·Ö

8.5

Îó²îÆ·¼¶

¸ßΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

µÍ

ʹÓÃÄѶÈ

¸ß

Óû§½»»¥

²»ÐèÒª

PoC/EXP

δ¹ûÕæ

ÔÚҰʹÓÃ

δ·¢Ã÷


GitLabÊÇÒ»¸ö»ùÓÚWebµÄDevOpsƽ̨£¬Ìṩ´Ó´úÂëÍйܡ¢°æ±¾¿ØÖÆ¡¢Ò»Á¬¼¯³ÉÓëÒ»Á¬½»¸¶£¨CI/CD£©¡¢´úÂëÉó²éµ½Çå¾²¼ì²âÓëÔËά¼à¿ØµÄÍêÕû¹¤¾ßÁ´¡£ËüÖ§³ÖGit¿ÍÕ»ÖÎÀí£¬×ÊÖú¿ª·¢ÍŶÓʵÏÖѸËÙ¿ª·¢ÓëЭͬÊÂÇ飬ÆÕ±éÓ¦ÓÃÓÚÆóÒµ¼¶Èí¼þ¿ª·¢Óë½»¸¶³¡¾°¡£GitLab·ÖΪÉçÇø°æ£¨CE£©ºÍÆóÒµ°æ£¨EE£©£¬ÁýÕÖ´Ó¿ªÔ´µ½ÉÌÒµ»¯µÄ¶àÌõÀíÐèÇó¡£


2025Äê9ÔÂ12ÈÕ£¬×ðÁú¿­Ê±¼¯ÍÅVSRC¼à²âµ½GitLab¹Ù·½ÐÞ¸´ÁËÒ»¸ö±£´æÓÚWebhook×Ô½ç˵ÇëÇóÍ·´¦Öóͷ£Âß¼­ÖеķþÎñ¶ËÇëÇóαÔ죨SSRF£©Îó²î£¨CVE-2025-6454£©¡£¸ÃÎó²îÔÊÐí¾­ÓÉÉí·ÝÑéÖ¤µÄÓû§ÔÚÊðÀíÇéÐÎÏÂͨ¹ý½á¹¹Ìض¨ÇëÇóÍ·ÐòÁУ¬ÈƹýУÑé»úÖÆ²¢ÏòÄÚ²¿ÏµÍ³Ìᳫ·ÇÔ¤ÆÚÇëÇó¡£Ò»µ©±»Ê¹Ó㬹¥»÷Õß¿ÉÄÜÔÚÒ»¶¨Ìõ¼þÏ»á¼ûÃô¸ÐÄÚ²¿·þÎñ»ò½øÒ»²½Ìᳫ¹¥»÷£¬¶ÔϵͳµÄÍêÕûÐÔÓëÇå¾²×é³ÉÑÏÖØÍþв¡£Îó²îÆÀ·Ö8.5·Ö£¬Îó²î¼¶±ð¸ßΣ¡£


¶þ¡¢Ó°Ïì¹æÄ£


16.11.0 <= GitLab < 18.1.6
18.2.0 <= GitLab < 18.2.6
18.3.0 <= GitLab < 18.3.2


Èý¡¢Çå¾²²½·¥


3.1 Éý¼¶°æ±¾


ÒÑÐû²¼ÐÞ¸´°æ±¾£¬Ç뽫GitLabÉý¼¶µ½Èçϰ汾¡£
GitLab >= 18.1.6
GitLab >= 18.2.6
GitLab >= 18.3.2


ÏÂÔØÁ´½Ó£ºhttps://about.gitlab.com/update/


3.2 ÔÝʱ²½·¥


ÔÝÎÞ¡£


3.3 ͨÓý¨Òé


? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬ïÔ̭ϵͳÎó²î£¬ÌáÉý·þÎñÆ÷µÄÇå¾²ÐÔ¡£
ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬Ð޸ķÀ»ðǽսÂÔ£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻò·þÎñ£¬ïÔÌ­½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬ïÔÌ­¹¥»÷Ãæ¡£
ʹÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£
ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬ÆôÓöàÒòËØÈÏÖ¤»úÖÆºÍ×îСȨÏÞÔ­Ôò£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏÞ¶È¡£
ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£


3.4 ²Î¿¼Á´½Ó


https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/
https://www.cve.org/CVERecord?id=CVE-2025-6454/