¡¾Îó²îͨ¸æ¡¿GitLab Webhook SSRFÎó²î (CVE-2025-6454)

Ðû²¼Ê±¼ä 2025-09-12

Ò»¡¢Îó²î¸ÅÊö


Îó²îÃû³Æ

GitLab Webhook SSRFÎó²î

CVE   ID

CVE-2025-6454

Îó²îÀàÐÍ

ЧÀͶËÇëÇóαÔì

·¢Ã÷ʱ¼ä

2025-09-12

Îó²îÆÀ·Ö

8.5

Îó²îÆ·¼¶

¸ßΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

µÍ

ʹÓÃÄѶÈ

¸ß

Óû§½»»¥

²»ÐèÒª

PoC/EXP

δ¹ûÕæ

ÔÚҰʹÓÃ

δ·¢Ã÷


GitLabÊÇÒ»¸ö»ùÓÚWebµÄDevOpsƽ̨£¬£¬£¬£¬£¬Ìṩ´Ó´úÂëÍйܡ¢°æ±¾¿ØÖÆ¡¢Ò»Á¬¼¯³ÉÓëÒ»Á¬½»¸¶£¨CI/CD£©¡¢´úÂëÉó²éµ½Çå¾²¼ì²âÓëÔËά¼à¿ØµÄÍêÕû¹¤¾ßÁ´¡£¡£¡£¡£¡£ËüÖ§³ÖGit¿ÍÕ»ÖÎÀí£¬£¬£¬£¬£¬×ÊÖú¿ª·¢ÍŶÓʵÏÖѸËÙ¿ª·¢ÓëЭͬÊÂÇ飬£¬£¬£¬£¬ÆÕ±éÓ¦ÓÃÓÚÆóÒµ¼¶Èí¼þ¿ª·¢Óë½»¸¶³¡¾°¡£¡£¡£¡£¡£GitLab·ÖΪÉçÇø°æ£¨CE£©ºÍÆóÒµ°æ£¨EE£©£¬£¬£¬£¬£¬ÁýÕÖ´Ó¿ªÔ´µ½ÉÌÒµ»¯µÄ¶àÌõÀíÐèÇ󡣡£¡£¡£¡£


2025Äê9ÔÂ12ÈÕ£¬£¬£¬£¬£¬918²©ÌìÌü¯ÍÅVSRC¼à²âµ½GitLab¹Ù·½ÐÞ¸´ÁËÒ»¸ö±£´æÓÚWebhook×Ô½ç˵ÇëÇóÍ·´¦Öóͷ£Âß¼­ÖеÄЧÀͶËÇëÇóαÔ죨SSRF£©Îó²î£¨CVE-2025-6454£©¡£¡£¡£¡£¡£¸ÃÎó²îÔÊÐí¾­ÓÉÉí·ÝÑéÖ¤µÄÓû§ÔÚÊðÀíÇéÐÎÏÂͨ¹ý½á¹¹Ìض¨ÇëÇóÍ·ÐòÁУ¬£¬£¬£¬£¬ÈƹýУÑé»úÖƲ¢ÏòÄÚ²¿ÏµÍ³Ìᳫ·ÇÔ¤ÆÚÇëÇ󡣡£¡£¡£¡£Ò»µ©±»Ê¹Ó㬣¬£¬£¬£¬¹¥»÷Õß¿ÉÄÜÔÚÒ»¶¨Ìõ¼þÏ»á¼ûÃô¸ÐÄÚ²¿Ð§ÀÍ»ò½øÒ»²½Ìᳫ¹¥»÷£¬£¬£¬£¬£¬¶ÔϵͳµÄÍêÕûÐÔÓëÇå¾²×é³ÉÑÏÖØÍþв¡£¡£¡£¡£¡£Îó²îÆÀ·Ö8.5·Ö£¬£¬£¬£¬£¬Îó²î¼¶±ð¸ßΣ¡£¡£¡£¡£¡£


¶þ¡¢Ó°Ïì¹æÄ£


16.11.0 <= GitLab < 18.1.6
18.2.0 <= GitLab < 18.2.6
18.3.0 <= GitLab < 18.3.2


Èý¡¢Çå¾²²½·¥


3.1 Éý¼¶°æ±¾


ÒÑÐû²¼ÐÞ¸´°æ±¾£¬£¬£¬£¬£¬Ç뽫GitLabÉý¼¶µ½ÈçÏ°汾¡£¡£¡£¡£¡£
GitLab >= 18.1.6
GitLab >= 18.2.6
GitLab >= 18.3.2


ÏÂÔØÁ´½Ó£ºhttps://about.gitlab.com/update/


3.2 ÔÝʱ²½·¥


ÔÝÎÞ¡£¡£¡£¡£¡£


3.3 ͨÓý¨Òé


? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬£¬£¬£¬ïÔ̭ϵͳÎó²î£¬£¬£¬£¬£¬ÌáÉýЧÀÍÆ÷µÄÇå¾²ÐÔ¡£¡£¡£¡£¡£
? ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬£¬£¬£¬£¬Ð޸ķÀ»ðǽսÂÔ£¬£¬£¬£¬£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻòЧÀÍ£¬£¬£¬£¬£¬ïÔÌ­½«Î£ÏÕЧÀÍ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬£¬£¬£¬£¬ïÔÌ­¹¥»÷Ãæ¡£¡£¡£¡£¡£
? Ê¹ÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬£¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£¡£¡£¡£¡£
? ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬£¬£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔ­Ôò£¬£¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£¡£¡£
? ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£¡£¡£¡£¡£


3.4 ²Î¿¼Á´½Ó


https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/
https://www.cve.org/CVERecord?id=CVE-2025-6454/