https://blog.qife122.com/tags/%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2/ Recent content in 环境变量泄露 on 办公AI智能小助手 Hugo zh-cn qife Sun, 09 Nov 2025 19:21:44 +0800 https://blog.qife122.com/p/github%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%89%96%E6%9E%90/ Sun, 09 Nov 2025 19:21:44 +0800 https://blog.qife122.com/p/github%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%89%96%E6%9E%90/ <h1 id="send-ing-myself-belated-christmas-gifts---githubcoms-environment-variables--ghes-shell">Send()-ing Myself Belated Christmas Gifts - GitHub.com&rsquo;s Environment Variables &amp; GHES Shell</h1> <h2 id="backstory">Backstory</h2> <p>2023年12月初，我在研究GitHub Enterprise Server（GHES）时发现了一个潜在的小漏洞。直到圣诞节后，我才找到时间分析这个漏洞，当时我完全没想到它会有如此大的影响。</p> https://blog.qife122.com/p/%E6%8F%AD%E7%A7%98github%E9%AB%98%E5%8D%B1%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/ Sat, 20 Sep 2025 11:05:00 +0800 https://blog.qife122.com/p/%E6%8F%AD%E7%A7%98github%E9%AB%98%E5%8D%B1%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/ <h1 id="send-ing-myself-belated-christmas-gifts---githubcoms-environment-variables--ghes-shell">Send()-ing Myself Belated Christmas Gifts - GitHub.com&rsquo;s Environment Variables &amp; GHES Shell</h1> <h2 id="目录">目录</h2> <ul> <li><a href="https://blog.qife122.com/p/%E6%8F%AD%E7%A7%98github%E9%AB%98%E5%8D%B1%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/#%e8%83%8c%e6%99%af%e6%95%85%e4%ba%8b">背景故事</a></li> <li><a href="https://blog.qife122.com/p/%E6%8F%AD%E7%A7%98github%E9%AB%98%E5%8D%B1%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/#ruby%e5%8f%8d%e5%b0%84%e5%bf%ab%e9%80%9f%e5%85%a5%e9%97%a8">Ruby反射快速入门</a></li> <li><a href="https://blog.qife122.com/p/%E6%8F%AD%E7%A7%98github%E9%AB%98%E5%8D%B1%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/#%e5%8f%91%e7%8e%b0%e6%bc%8f%e6%b4%9e">发现漏洞</a></li> <li><a href="https://blog.qife122.com/p/%E6%8F%AD%E7%A7%98github%E9%AB%98%E5%8D%B1%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/#%e5%af%bb%e6%89%be%e5%bd%b1%e5%93%8d">寻找影响</a></li> <li><a href="https://blog.qife122.com/p/%E6%8F%AD%E7%A7%98github%E9%AB%98%E5%8D%B1%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/#%e7%ad%9b%e9%80%89%e5%80%99%e9%80%89%e6%96%b9%e6%b3%95">筛选候选方法</a></li> <li><a href="https://blog.qife122.com/p/%E6%8F%AD%E7%A7%98github%E9%AB%98%E5%8D%B1%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/#%e8%8e%b7%e5%8f%96%e7%8e%af%e5%a2%83%e5%8f%98%e9%87%8f">获取环境变量</a></li> <li><a href="https://blog.qife122.com/p/%E6%8F%AD%E7%A7%98github%E9%AB%98%E5%8D%B1%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/#%e5%ae%9e%e9%99%85%e5%bd%b1%e5%93%8d">实际影响</a></li> <li><a href="https://blog.qife122.com/p/%E6%8F%AD%E7%A7%98github%E9%AB%98%E5%8D%B1%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/#%e8%8e%b7%e5%8f%96%e8%bf%9c%e7%a8%8b%e4%bb%a3%e7%a0%81%e6%89%a7%e8%a1%8crce">获取远程代码执行（RCE）</a></li> <li><a href="https://blog.qife122.com/p/%E6%8F%AD%E7%A7%98github%E9%AB%98%E5%8D%B1%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/#%e5%88%a9%e7%94%a8%e6%9d%a1%e4%bb%b6">利用条件</a></li> <li><a href="https://blog.qife122.com/p/%E6%8F%AD%E7%A7%98github%E9%AB%98%E5%8D%B1%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/#%e5%bb%ba%e8%ae%ae%e7%bc%93%e8%a7%a3%e6%8e%aa%e6%96%bd">建议缓解措施</a></li> <li><a href="https://blog.qife122.com/p/%E6%8F%AD%E7%A7%98github%E9%AB%98%E5%8D%B1%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/#%e6%a3%80%e6%b5%8b%e6%8c%87%e5%af%bc">检测指导</a></li> <li><a href="https://blog.qife122.com/p/%E6%8F%AD%E7%A7%98github%E9%AB%98%E5%8D%B1%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/#%e6%97%b6%e9%97%b4%e7%ba%bf">时间线</a></li> <li><a href="https://blog.qife122.com/p/%E6%8F%AD%E7%A7%98github%E9%AB%98%E5%8D%B1%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/#%e7%bb%93%e6%9d%9f%e8%af%ad">结束语</a></li> </ul> <h2 id="背景故事">背景故事</h2> <p>2023年12月初，我在研究GitHub Enterprise Server（GHES）。休假前一天，我发现了一个潜在（但可能影响较小）的漏洞。圣诞节后，我终于有时间分析和评估这个潜在漏洞。当时，我完全没想到这个漏洞会有如此大的影响……直到一次意外发生。</p> https://blog.qife122.com/p/github%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/ Fri, 05 Sep 2025 01:24:54 +0800 https://blog.qife122.com/p/github%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%B3%84%E9%9C%B2%E4%B8%8Eghes%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/ <h1 id="send-ing-myself-belated-christmas-gifts---githubcoms-environment-variables--ghes-shell">Send()-ing Myself Belated Christmas Gifts - GitHub.com&rsquo;s Environment Variables &amp; GHES Shell</h1> <h2 id="目录">目录</h2> <ul> <li>背景故事</li> <li>Ruby反射快速入门</li> <li>发现漏洞</li> <li>寻找影响</li> <li>筛选候选方法</li> <li>获取环境变量</li> <li>实际影响</li> <li>获取远程代码执行（RCE）</li> <li>利用条件</li> <li>建议缓解措施</li> <li>检测指南</li> <li>时间线</li> <li>结束语</li> </ul> <h2 id="背景故事">背景故事</h2> <p>2023年12月初，我正在对GitHub Enterprise Server（GHES）进行研究。在休假前一天，我找到了一个潜在（但可能较小）的漏洞。圣诞节后的一天，我终于有时间对这个潜在漏洞进行分析和评估。当时，我完全没有预料到这个漏洞会有如此大的影响……直到一个意外发生。</p>