Unauthenticated GraphQL Directive Code Injection in GitLab CE/EE

This four-file repository contains a standalone Python exploit and a Dockerized vulnerable GitLab CE lab. gitlab_exploit.py is the primary entry point. It accepts a host/port or URL, defaults to http when no scheme is supplied, and performs all requests without Authorization or PRIVATE-TOKEN headers. In destructive mode it verifies an anonymously reachable public repository through GET /api/v4/projects/<repo>, posts a GraphQL query to /api/graphql using @gl_introduced(version:"99.0.0") and the field name destroy, then polls the REST API for a 404 response. Its --detect mode uses to_param rather than destroy, providing a non-destructive behavioral check. TLS certificate validation can be disabled with --insecure. The stated vulnerability is an unauthenticated GraphQL fallback/arbitrary zero-argument method invocation affecting GitLab Project objects; the implemented impact is deletion of a selected public project. The Python code does not enumerate projects, authenticate, establish persistence, or provide remote shell execution. The supplied query is basic and largely fixed apart from the project path, making this an operational PoC rather than a framework-integrated or weaponized exploit. Dockerfile builds from gitlab/gitlab-ce:19.2.2-ce.0, configures GitLab at localhost:80, exposes port 80, and starts seed.sh in the background. seed.sh waits for the local GraphQL service, then uses gitlab-rails runner to create/confirm a victim user and create the public victim/demo project. README.md documents Docker port publishing as host port 3000 to container port 80, claimed affected/fixed GitLab versions, and example invocation. The repository contains no original repository URL, git reference, or archive size in the supplied material.

Repository is a small self-contained GitLab vulnerability lab and PoC set with 5 files: a README, Docker Compose lab definition, two Python PoCs, and a Bash setup script. The main exploit file, poc_cve_2026_19478.py, targets CVE-2026-19478 in GitLab GraphQL. It sends POST requests to /api/graphql with attacker-controlled GraphQL fields annotated by @gl_introduced(version:"99.0.0") so that on vulnerable servers the fallback path resolves the field by calling object.public_send(field_name). In safe mode it probes with a harmless zero-argument method such as to_param against a public project and treats a non-null response as evidence of arbitrary method invocation. In optional proof mode, it first uses the authenticated REST API (/api/v4/projects) to create a disposable public project, then sends an unauthenticated GraphQL query requesting the destroy field to trigger Project#destroy, and finally verifies deletion via GET /api/v4/projects/{id}. This demonstrates unauthenticated destructive impact against public projects. The second PoC, poc_cve_2026_19650.py, is a safe detector for the sibling CVE-2026-19650. It submits a two-element Apollo-style GraphQL batch to /api/graphql and checks whether slot 0 incorrectly returns slot 1 data, indicating multiplex query/document swapping caused by shared tracer state. The repository also includes docker-compose.yml, which provisions two GitLab CE containers for A/B testing: vulnerable 19.2.2-ce.0 on port 8222 and patched 19.2.4-ce.0 on port 8224. setup.sh waits for GraphQL readiness, seeds a public project at root/pub, and creates an admin personal access token on each instance for lab use. Overall, this is a real exploit repository with both detection and optional impact-proof capability, focused on unauthenticated GraphQL abuse in GitLab rather than a generic scanner or framework module.

This repository is a small standalone Python PoC for CVE-2026-19478 affecting GitLab GraphQL. It contains one executable script (poc.py), a README with usage and vulnerability details, and a license file. The exploit is not part of a larger framework. The script’s structure is straightforward: it defines affected version ranges, helper routines for parsing and comparing versions, an HTTP wrapper around requests, version detection logic, GraphQL query construction, and a main routine that selects a target and method based on CLI arguments. Version detection is best-effort and checks /api/v4/version when a PRIVATE-TOKEN is supplied, then falls back to scraping /help and /users/sign_in. Core exploit behavior: the PoC builds a GraphQL query against either project(fullPath: ...) or user(username: ...), then injects an attacker-chosen field name decorated with @gl_introduced(version: "999.0.0"). According to the repository, vulnerable GitLab versions create a fallback field and resolve it via object.public_send(), enabling arbitrary zero-argument method invocation on the underlying Project or User model. This allows safe verification with touch, state-changing actions such as deactivate/block/confirm/activate, and destructive actions such as destroy or delete. Operationally, the exploit supports modes check, modify, destroy, delete, and custom. The default benign check uses touch. Modify maps to deactivate for users and touch for projects. Destroy and delete are explicitly destructive and gated by an interactive confirmation prompt. The exploit expects public objects; if the project or user is not resolvable through GraphQL, the method will not be invoked. Overall, this is a real exploit PoC rather than a detector-only script. It includes both vulnerability assessment logic and active exploitation capability, with hardcoded but flexible method selection, making it OPERATIONAL rather than merely demonstrative.