GitLab v18.11.3 Critical RCE: Detection and Hardening for Jupyter Diff Flaw

---
title: GitLab RCE - Git User Spawning Shell
id: 8a4b2c1d-9e6f-4a3b-8c5d-1e2f3a4b5c6d
status: experimental
description: Detects the git user spawning interactive shells or utilities, indicative of successful RCE on GitLab servers.
references:
  - https://thehackernews.com/2026/07/researcher-publishes-gitlab-rce-poc.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    User|contains: 'git'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/python'
      - '/perl'
      - '/nc'
      - '/curl'
  condition: selection
falsepositives:
  - Legitimate administrative debugging by git user (rare)
level: critical
---
title: GitLab RCE - GitLab-Workhorse Spawning System Commands
id: 9c5d3e2f-0a7g-5b4c-9d6e-2f3a4b5c6d7e
status: experimental
description: Detects the main GitLab web process spawning suspicious child processes often used in post-exploitation.
references:
  - https://thehackernews.com/2026/07/researcher-publishes-gitlab-rce-poc.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentImage|contains:
      - '/gitlab-workhorse'
      - '/gitaly'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/wget'
  condition: all of selection_*
falsepositives:
  - Authorized administrative scripts
level: high

DeviceProcessEvents
| where Timestamp > ago(7d)
| where AccountName contains "git"
| where ProcessCommandLine contains "-c" or 
   ProcessVersionInfoOriginalFileName in ("bash.exe", "sh.exe", "python.exe", "perl.exe") or
   FileName in ("bash", "sh", "zsh", "python", "perl", "nc", "curl", "wget")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

-- Hunt for processes running as the git user that are not standard git operations
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Username =~ 'git'
  AND Name NOT IN ('git', 'git-remote-http', 'git-remote-https', 'git-credential-cache', 'sshd')
  AND Name =~ '(bash|sh|zsh|python|perl|nc|curl|wget|chmod|chown)'

#!/bin/bash

# GitLab Hardening and Version Check Script
# Checks for version 18.11.3 and lists active git user processes

echo "[*] Checking GitLab Version..."
# Attempt to retrieve version using gitlab-rake or checking the VERSION file
if [ -f "/opt/gitlab/embedded/service/gitlab-rails/VERSION" ]; then
    CURRENT_VERSION=$(cat /opt/gitlab/embedded/service/gitlab-rails/VERSION)
    echo "Detected GitLab Version: $CURRENT_VERSION"
    
    if [ "$CURRENT_VERSION" == "18.11.3" ]; then
        echo "[!] CRITICAL: This instance is running a vulnerable version (18.11.3)."
        echo "[!] Action Required: Patch immediately to the latest secure version."
    else
        echo "[+] Version does not match the specific vulnerable release 18.11.3."
    fi
else
    echo "[-] Could not automatically determine version. Please verify manually."
fi

echo ""
echo "[*] Auditing processes running as 'git' user..."
# Check for suspicious shells or tools running as git
SUSPICIOUS_PROCS=$(ps -u git -o pid,comm,args | grep -E '(bash|sh|zsh|python|perl|nc|curl|wget)' | grep -v grep)

if [ -n "$SUSPICIOUS_PROCS" ]; then
    echo "[!] WARNING: Found non-standard processes running as git user:"
    echo "$SUSPICIOUS_PROCS"
    echo "[!] Investigate these PIDs immediately."
else
    echo "[+] No suspicious shells or utilities detected for git user."
fi

echo "[*] Remediation Recommendation:"
echo "1. Upgrade GitLab to the latest patched release available at https://about.gitlab.com/releases/"
echo "2. If immediate patching is impossible, consider restricting Jupyter notebook rendering or diff capabilities via application configuration (if supported)."