Remote Code Execution in GitLab CI/CD Regular-Expression Compiler

The supplied repository contains 28 files: seven Python programs, one Bash script, two substantive C source/header files, documentation and SVG assets, target/revision configuration, reports, and evidence logs. Four additional C/header-named files contain only '404: Not Found' and are not functional source. This is standalone laboratory exploitation tooling, not an identified Metasploit, Nuclei, or other established framework integration. The primary path is cve97229_cli.py -> SSH/SCP -> remote_exploit.py. Discovery retrieves /users/sign_in, maps gon.revision using revision_map.json, and optionally hashes the container's libruby through privileged host access. Exploitation selects a known MD5 layout, creates a public project through Rails runner, commits a crafted regex and UTF-8 filename, pushes a random branch using embedded lab credentials, starts an HTTP shell-stage/output listener, and triggers CI lint without an Authorization header. The documented mechanism uses a split quantifier containing (?#), repeated word-character classes, and more than 2 GiB of compiled regex bytecode to attempt control-flow redirection into system(). Only STEP is used from the selected layout in the visible payload builder; FINISH and GADGET are assigned but not directly incorporated, so their presence alone does not demonstrate gadget targeting. The current CLI and remote script contain working-layout claims for GitLab CE 19.4.1 and 19.2.7, skip unresolved 19.3.4, and treat the known 19.4.2 hash as patched. Supplied logs report git-account command output and a 19.4.2 negative control. These are repository-provided assertions, not independent verification of the CVE, advisory, exploit reliability, or patch status. HTTP 502/EOF and worker crashes alone cannot distinguish exploitation from OOM or other failures. Moreover, any POST to the callback handler can produce an RCE result because neither path nor nonce is checked. Supporting files include older batch variants cve97229.py and cve97229_v2.py, the experimental 19.3.4 script poc/poc_1934.py, an ELF helper, matrix scripts, and partial Onigmo reference sources. The two older batch files are truncated in the supplied content. matrix_sweep.py checks existing containers and records layouts rather than implementing the deployment and RCE attempts promised by its docstring; it can label an unresolved layout exploitable. matrix_sweep.sh is not valid Bash. elf_analyze.py has a symbol-entry unpacking mismatch, incorrect symbol-string-table addressing, and assumes virtual addresses can index file bytes, undermining its offset derivation. Operational hazards include disabling SSH host-key checks and HTTPS verification, exposing an unauthenticated command-stage listener on all interfaces, embedding account credentials, and killing existing users of the callback port. The documentation's 'unauthenticated RCE' label applies to the final lint request, not the complete delivered workflow, which depends on repository write credentials and substantial SSH/Docker privileges. No public command-and-control endpoint or concealed destructive payload is evident. Original repository URL, git reference, and archive size were not supplied; empty strings and zero represent unavailable metadata.

The supplied repository contains eight files: one README and seven Python modules. It is a standalone exploit implementation with defensive-looking companion utilities, not a recognized exploitation framework. No repository URL, Git reference, or archive size was supplied; the repository metadata uses empty strings and zero for these unknown values. poc.py implements payload generation, Git deployment, unauthenticated CI lint delivery, and an HTTP callback server. It constructs a short regex with a comment-split repeat count and character classes encoding forged Onigmo VM instructions, then creates a UTF-8 filename carrying additional exploit data and a short shell stager. The claimed chain bypasses regex size/repeat checks, triggers integer overflow during recompilation, and redirects execution to a libruby system gadget. These are repository claims supported by exploit-oriented code, not independently confirmed behavior. Hardcoded offsets constrain the implementation to its claimed GitLab CE 19.4.1 amd64 target, despite broader CE/EE version claims. The operator must first authenticate to push malicious project content; only the subsequent lint request is unauthenticated. The exploit clones the project, stages all changes, commits and pushes a random branch, then requests CI lint with content_ref set to that branch. Its callback serves a shell script and receives command output. No fixed external command-and-control address is visible: GitLab, Git remote, and callback destinations are operator supplied. The remote branch is not cleaned up. HTTP 502 or a stopped worker alone does not establish successful command execution. Companion modules provide offline concurrent version classification (bulk_check.py), hardcoded version comparisons (version_check.py), URL construction and exposure guidance without active probing (lint_audit.py), heuristic regex scanning (regex_scanner.py), and patch guidance (remediation.py). Their affected-version and patch claims are not independently validated. A significant analysis limitation is lib/hex.py: its supplied contents are truncated. Although presented as encoding utilities, it imports base64, urllib.request, and subprocess under the alias char. poc.py imports this module and unconditionally calls hex.character_dump() before argument parsing, including before processing --help. That function's implementation is not visible in the supplied excerpt, so its existence and behavior cannot be assessed. Hidden local execution or network activity cannot be ruled out, and the repository should not be considered safe to run based on the visible exploit flow. There is insufficient evidence to classify it definitively as a fake exploit, but neither its legitimacy nor its complete behavior is established.

The repository contains three files: .gitignore, README.md, and the standalone Python exploit poc.py. Python uses only standard-library modules and invokes the external Git client; it also generates YAML configuration and a POSIX shell callback stage. There is no identified exploit framework. The code constructs character-class bitmaps containing Onigmo VM instructions and a repeat count of 57,805, obscured as {5(?#)7805}. According to the README, this bypasses GitLab's repeat scanner, while a UTF-8 repository path forces recompilation after an initial compiled-size check. The claimed 37,151-byte repeated unit crosses the signed 32-bit boundary, wrapping a branch offset into attacker-controlled bitmap bytes. Subsequent stages attempt to redirect the interpreter stack into the crafted path and derive an ASLR-tolerant system() target. The native layout and offsets are fixed to the documented build. The executable workflow starts a callback HTTP server, shallow-clones the authenticated project, creates malicious CI content and a specially named file, commits and pushes a random branch, then sends an unauthenticated CI lint GET selecting that branch. The callback serves an operator-controlled command script and collects its output. Thus the delivery request is anonymous, but the complete attack requires prior project write access. The README reports expected HTTP 502 responses from worker crashes and significant memory consumption; neither a 502 nor a timeout alone establishes successful execution. Static inspection supports classification as an exploit implementation rather than a detector or README-only repository, with no obvious unrelated destructive or credential-stealing behavior. However, execution success, the CVE assignment, affected-version claims, CVSS rating, and reported test results have not been independently verified. No original repository URL, git reference, or archive size was provided; empty repository identifiers and a zero size represent unavailable metadata. The listed file sizes total 14,435 bytes, which is not an archive-size measurement.