GitLab CE/EE CVSS 10.0 Unauthenticated CI/CD Regex RCE: Detection and Emergency Remediation Guide

---
title: GitLab Service Spawning Shell or Downloader
id: 3d5d2b10-8f9a-4b0e-9c1a-gitlab001aa01
status: experimental
description: Detects GitLab application or runner processes spawning shells, downloaders, or scripting interpreters consistent with post-RCE behavior after a crafted CI/CD input.
references:
  - https://thehackernews.com/2026/10/gitlab-patches-cvss-100-flaw-that-could.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - '/opt/gitlab/'
      - 'puma'
      - 'sidekiq'
      - 'gitlab-workhorse'
      - 'gitaly'
      - 'gitlab-runner'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/ruby'
      - '/curl'
      - '/wget'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - GitLab maintenance tasks, backup jobs, legitimate runner builds, and administrator shells executed from GitLab CI. Baseline runner images and approved job commands before deployment.
level: high
---
title: Suspicious Nested Regex Payload in GitLab CI/CD Logs
id: 7c0b9e22-6d1f-4a43-b5d2-gitlab002bb02
status: experimental
description: Detects very long or nested-quantifier regular expression strings in GitLab-related application, nginx, or syslog telemetry that may indicate crafted CI/CD regex probing.
references:
  - https://thehackernews.com/2026/10/gitlab-patches-cvss-100-flaw-that-could.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: application
  product: linux
  service: gitlab
detection:
  selection_regex_indicators:
    Message|contains:
      - '(.+)+'
      - '(.*)*'
      - '(a+)+'
      - '\\w+\\w+'
      - 'catastrophic'
      - 'regexp'
      - 'regex'
      - 'ci/cd'
      - 'pipeline'
      - 'trigger'
  selection_length:
    Message|re: '.{800,}'
  condition: selection_regex_indicators and selection_length
falsepositives:
  - Legitimate complex CI linting, debugging, security scanner output, and validator examples. Restrict to GitLab application/nginx ingress logs and alert on unauthenticated source contexts first.
level: medium
---
title: GitLab Host Writes Executable Content to Temp or Shared Memory
id: 9a1e6f30-2c7d-4b5a-8e61-gitlab003cc03
status: experimental
description: Detects GitLab-related processes writing executable files or scripts into temporary, shared-memory, or world-writable locations commonly used after server-side code execution.
references:
  - https://attack.mitre.org/techniques/T1105/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/06
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: file_event
  product: linux
detection:
  selection_process:
    ProcessName|contains:
      - 'puma'
      - 'sidekiq'
      - 'gitlab-workhorse'
      - 'gitaly'
      - 'gitlab-runner'
      - 'ruby'
  selection_path:
    TargetFilename|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - '/run/user/'
  selection_ext:
    TargetFilename|endswith:
      - '.sh'
      - '.py'
      - '.pl'
      - '.rb'
      - '.elf'
      - '.so'
  condition: selection_process and selection_path and selection_ext
falsepositives:
  - CI builds may legitimately write scripts and artifacts. Scope to non-runner application services and alert when the writer is web-facing rather than an approved runner executor.
level: high

// Hunt GitLab Linux telemetry in Sentinel via Syslog/CEF for shell or downloader children of GitLab services
let gitlabParents = dynamic(['puma','sidekiq','gitlab-workhorse','gitaly','gitlab-runner','ruby']);
let riskyChildren = dynamic(['/bin/sh','/bin/bash','/usr/bin/curl','/usr/bin/wget','python','python3','perl','base64','nc','ncat']);
Syslog
| where TimeGenerated > ago(24h)
| where ProcessName has_any (gitlabParents) or SyslogMessage has_any (gitlabParents)
| where SyslogMessage has_any (riskyChildren)
| extend Suspicious = SyslogMessage has_any (dynamic(['curl http','wget http','base64 -d','/dev/shm','/tmp/','chmod +x','bash -i','nc -e']))
| summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Samples=make_list(SyslogMessage, 5) by Computer, ProcessName, SeverityLevel, Suspicious
| order by Suspicious desc, Count desc;
// Hunt ingress/CEF web logs for unauthenticated requests carrying long regex-like CI/CD payloads
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceProduct has 'GitLab' or ApplicationProtocol has 'http' or DestinationHostName has 'gitlab'
| where RequestMethod in ('POST','PUT','PATCH')
| where RequestURL has_any (dynamic(['/api/v4','/ci','/pipelines','/trigger','/jobs','/webhooks','/-/']))
| extend PayloadLen = strlen(coalesce(RequestContext, AdditionalExtensions))
| where PayloadLen > 1500 or RequestContext has_any (dynamic(['(.+)+','(.*)*','regex','regexp','pipeline','trigger']))
| summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Urls=make_set(RequestURL, 20) by SourceIP, DestinationHostName, RequestMethod, PayloadLen
| order by Count desc;
// Correlate new external connections from GitLab servers after suspicious web hits
let suspiciousSources = CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has_any (dynamic(['/api/v4','/ci','/pipelines','/trigger','/-/']))
| summarize by SourceIP;
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName has_any (dynamic(['ruby','puma','sidekiq','gitlab-runner','curl','wget','bash','sh']))
| where RemoteIP in (suspiciousSources) or RemotePort in (80,443,53,4444,1337,8080)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| order by TimeGenerated desc;

-- Velociraptor artifact: hunt Linux GitLab hosts for suspicious child processes, temp executables, and unexpected egress
LET suspicious_proc = SELECT Pid, Ppid, Name, Exe, Cmdline, Username, CreateTime
FROM pslist()
WHERE (
  Exe =~ '(gitlab|puma|sidekiq|workhorse|gitaly|runner|ruby)'
  AND Cmdline =~ '(bash|sh|curl|wget|python|perl|base64|nc |ncat|/tmp|/dev/shm|chmod \+x)'
) OR (
  Cmdline =~ '(curl http|wget http|base64 -d|bash -i|nc -e|/dev/shm|/var/tmp)'
)

LET temp_files = SELECT FullPath, Size, Mtime, Ctime, Mode.String AS Mode
FROM glob(globs=['/tmp/*','/var/tmp/*','/dev/shm/*','/opt/gitlab/tmp/*','/var/opt/gitlab/tmp/*'])
WHERE FullPath =~ '\.(sh|py|pl|rb|elf|so)$'
   OR Mode =~ 'x'

LET egress = SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, State, Cmdline
FROM netstat()
WHERE Name =~ '(ruby|puma|sidekiq|gitlab-runner|curl|wget|bash|sh)'
  AND RemotePort in (80,443,53,4444,1337,8080,9001)

SELECT * FROM suspicious_proc
UNION ALL SELECT NULL AS Pid, NULL AS Ppid, 'TEMP_FILE:' + FullPath AS Name, FullPath AS Exe, Mode AS Cmdline, Size AS Username, Mtime AS CreateTime FROM temp_files
UNION ALL SELECT Pid, NULL AS Ppid, 'NET:' + Name AS Name, Cmdline AS Exe, LocalAddr + ':' + LocalPort + ' -> ' + RemoteAddr + ':' + RemotePort AS Cmdline, State AS Username, NULL AS CreateTime FROM egress

#!/usr/bin/env bash
set -euo pipefail
# GitLab emergency verification/patch helper. Test in staging; confirm fixed versions in GitLab release notes before production use.

echo '== Inventory =='
if command -v gitlab-rake >/dev/null 2>&1; then
  gitlab-rake gitlab:env:info || true
fi
for pm in dpkg rpm; do
  if command -v "$pm" >/dev/null 2>&1; then
    "$pm" -l 2>/dev/null | grep -E 'gitlab-(ce|ee)' || "$pm" -qa 2>/dev/null | grep -E 'gitlab-(ce|ee)' || true
  fi
done
if command -v docker >/dev/null 2>&1; then
  docker ps --format '{{.Names}} {{.Image}}' | grep -i gitlab || true
fi

echo '== Exposure checks =='
for f in /etc/gitlab/gitlab.rb /home/git/gitlab/config/gitlab.yml; do
  [ -f "$f" ] && grep -E 'signup_enabled|project_creation|visibility|ci|runner|external_url|pages|registry' "$f" | sed 's/\(password\|secret\|token\).*/\1=REDACTED/I' || true
done
ss -ltnp | grep -E ':(80|443|22|5050|8080|9090)\b' || true

echo '== Backup before upgrade =='
STAMP=$(date -u +%Y%m%dT%H%M%SZ)
mkdir -p "/root/gitlab-emergency-$STAMP"
cp -a /etc/gitlab "/root/gitlab-emergency-$STAMP/" 2>/dev/null || true
if command -v gitlab-backup >/dev/null 2>&1; then
  gitlab-backup create STRATEGY=copy || true
fi

echo '== Package upgrade path =='
echo 'Review https://about.gitlab.com/releases/categories/releases/ and GitLab security advisories for the exact fixed build for your installed version.'
if command -v apt-get >/dev/null 2>&1; then
  apt-get update
  apt-get install -y --only-upgrade gitlab-ce || apt-get install -y --only-upgrade gitlab-ee
elif command -v dnf >/dev/null 2>&1; then
  dnf update -y gitlab-ce || dnf update -y gitlab-ee
elif command -v yum >/dev/null 2>&1; then
  yum update -y gitlab-ce || yum update -y gitlab-ee
else
  echo 'No supported package manager found. For containers/helm/source installs, update the image/chart per GitLab guidance.'
fi

echo '== Post-upgrade health =='
gitlab-ctl reconfigure || true
gitlab-ctl restart || true
gitlab-rake gitlab:check SANITIZE=true || true
gitlab-rake gitlab:status || true

echo '== Quick compromise checks =='
ps -eo pid,ppid,user,comm,args | grep -E 'gitlab|puma|sidekiq|workhorse|gitaly|runner|ruby' | grep -E 'bash|sh|curl|wget|python|perl|base64|nc|ncat' || true
find /tmp /var/tmp /dev/shm /opt/gitlab/tmp /var/opt/gitlab/tmp -type f \( -name '*.sh' -o -name '*.py' -o -name '*.rb' -o -name '*.elf' -o -perm -111 \) -mmin -1440 -ls 2>/dev/null || true