CVE-2025-7734

GitHubCurated repository PoCExploitCexploitintel/eip-pocs-and-cves

PoC files

20 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The primary artifact is a full exploit chain for CVE-2025-7734, a stored XSS vulnerability in GitLab's code navigation feature. The main PoC script (poc.py) automates project creation, payload file commit, LSIF artifact setup, and headless browser verification to trigger and confirm JavaScript execution in the victim's browser session.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a collection of documentation, Python scripts, HTML, and Node.js files that demonstrate a stored XSS vulnerability (CVE-2025-7734) in GitLab. All code performs expected exploit-related actions: creating projects, uploading payloads, generating LSIF artifacts, and verifying the vulnerability via API calls, headless browsers, and standalone simulations. No concealed, deceptive, or materially misrepresented behavior that harms the operator or an unrelated system was found.

ClassificationExploit
Model confidence98%
AuthenticationRequired
LanguagesPythonJavaScriptHTMLShell
Target softwareGitLab CE/EE
Attack typesStored Cross-Site Scripting (XSS)Account Takeover
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact, poc.py, is an exploit. It is a Python script that automates the full attack chain to trigger and verify a stored XSS vulnerability. It creates a malicious project, commits a payload, sets up the required LSIF artifact, and uses a headless browser to confirm JavaScript execution (e.g., alert dialog detection). This goes beyond scanning or detection; it actively exercises the vulnerability to achieve code execution in the victim's browser context.

poc.py:1-26poc.py:195-204poc.py:470-481

Requirements

  • Authenticated GitLab user with Developer role (write access) to create a project and commit files.poc.py:19-20
  • Target GitLab instance running a vulnerable version (14.2.0 through 18.0.5, 18.1.0 through 18.1.3, or 18.2.0 through 18.2.1).poc.py:20
  • A victim user must view the attacker's crafted file in the GitLab blob viewer.poc.py:15

Observed behavior

  • Creates a new GitLab project or uses an existing one via the API.poc.py:256-279
  • Commits a Python source file containing XSS payloads (e.g., <img/src/onerror=...>) as string literals.poc.py:48-54
  • Creates a .gitlab-ci.yml configuration to generate a legacy LSIF artifact (without an end_line property) that triggers the vulnerable code path.poc.py:57-78
  • Verifies the LSIF data endpoint serves the vulnerable-format entries.poc.py:377-442
  • Uses a headless browser (Playwright) to log in, navigate to the blob viewer, and detect XSS execution via alert dialogs and DOM inspection.poc.py:513-640
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
https://exploit-intel.comAuthor attribution URL found in multiple script headers.poc.py:3
Url
http://localhost:8880Target URL for the local Docker-based GitLab lab environment.CVE-LAB.md:37
Credential
root / LabPass2025!Default credentials for the local GitLab lab container.README.md:63-64
Command
docker exec cve-2025-7734-gitlab gitlab-rails runner 'user = User.find_by_username("root"); token = user.personal_access_tokens.create!(...)'Command to create a personal access token on the local target GitLab instance.poc.py:237-245
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating not all files from the repository unit were included. The analysis is based on the 7 selected text files provided.
  • The headless browser verification in poc.py requires the Playwright library, which is noted as optional and may not be installed, potentially limiting full exploit chain execution in some environments.
  • Binary files (e.g., xss_evidence.png) and other non-text media were not analyzed.
  • The review is limited to the static content of the provided files; dynamic behavior or network connections at runtime were not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

CVE-2025-7734/docker-compose.yml

Created Vuln labCVE-2025-7734Compose · mixed

1 Compose manifest · 1 Dockerfile · 1 service

Lab screenshot for CVE-2025-7734/docker-compose.yml
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment running GitLab CE 18.0.5, a version vulnerable to CVE-2025-7734, a stored XSS in the code navigation feature. The environment is designed for security research and PoC verification.

CVE-2025-7734/docker-compose.yml:1-46CVE-2025-7734/README.md:1-215

Lab assessment

Vulnerability lab

The README explicitly states the environment is a 'Lab Environment' for CVE-2025-7734, a stored XSS in GitLab. It provides setup instructions, credentials, and PoC usage details. The Docker Compose file builds a specific vulnerable version of GitLab CE (18.0.5).

CVE-2025-7734/README.md:1-3CVE-2025-7734/docker-compose.yml:10-11
Lab shapeCompose · mixed
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

vulnerable

vulnerable GitLab CE 18.0.5 target

A Docker service built from gitlab/gitlab-ce:18.0.5-ce.0. It runs the full GitLab stack (Rails, PostgreSQL, Redis, Nginx, etc.) and is configured with a known root password. It exposes port 80 on the host's port 8880.

CVE-2025-7734/docker-compose.yml:9-42CVE-2025-7734/Dockerfile.vulnerable:1
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-7734

Supported by supplied evidence

The lab environment is explicitly built around CVE-2025-7734. The README details the vulnerability, affected versions (including 18.0.5), and the lab setup uses the exact vulnerable image gitlab/gitlab-ce:18.0.5-ce.0. Multiple PoC scripts are provided to demonstrate the exploit.

CVE-2025-7734/README.md:1-3CVE-2025-7734/Dockerfile.vulnerable:1CVE-2025-7734/poc.py:1-30
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker Engine with Docker Compose pluginCVE-2025-7734/README.md:55-56
  • ~4GB free RAM (8GB recommended) and ~5GB free disk spaceCVE-2025-7734/README.md:57-58
  • Wait ~3 minutes for GitLab to initialize after `docker compose up -d`CVE-2025-7734/README.md:63-64
  • Root credentials: username 'root', password 'LabPass2025!'CVE-2025-7734/README.md:76-78

Evidence-described exercise path

  1. Start the lab environment with `docker compose up -d` and wait for the GitLab service to become healthy.CVE-2025-7734/README.md:63-64
  2. Run the automated setup script `./setup-gitlab.sh http://localhost:8880 LabPass2025!` to create a project, payload file, and CI configuration.CVE-2025-7734/README.md:87-88
  3. Execute the primary PoC script `poc.py` to automate the exploit chain, or use `poc_vector2.py` for Node.js engine verification, or open `poc_vector2_standalone.html` in a browser for a standalone demonstration.CVE-2025-7734/README.md:95-110
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own vulnerable GitLab target. The PoC scripts interact with the local Docker container to demonstrate the XSS vulnerability. There is no evidence of host compromise, data destruction, credential theft, or communication with external systems beyond the documented lab setup. The use of `docker exec` in `poc.py` is for creating a PAT within the lab container, which is a documented prerequisite for the exercise.

CVE-2025-7734/poc.py:195-210CVE-2025-7734/README.md:1-215
Review boundaries

What the analysis did not establish

  • The packet does not include the Dockerfile.vulnerable content beyond the FROM instruction, but the base image is a well-known public image.
  • The packet includes binary files (e.g., xss_evidence.png) that are not inspected.
  • The safety assessment is based on static analysis of the provided scripts and configuration; runtime behavior is not observed.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

2