FaLLenSKiLL1 Exploits and Proofs of Concept

Showing 4 PoCs on this page

GitHub

FaLLenSKiLL1/CVE-2024-6678

Repository PoC4Created 2026-05-21ExploitCVE-2024-66782 files

29.6 KiB

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

A Python script that exploits CVE-2024-6678 in GitLab by triggering pipeline schedules as an arbitrary user. It includes reconnaissance, schedule triggering via REST and GraphQL APIs, a protected-ref bypass using ambiguous tags, and an optional CI YAML patching step to exfiltrate environment variables.

Backdoor review

No backdoor observed in reviewed code

The PoC script (CVE-2024-6678-poc.py) and README.md implement and document a legitimate exploit for CVE-2024-6678, which triggers GitLab pipeline schedules as an arbitrary user. The code performs only the described exploit actions: authenticating, enumerating schedules, triggering pipelines via REST/GraphQL, optionally patching .gitlab-ci.yml for CI variable exfiltration, and restoring the original file. No concealed backdoor, unrelated payload, persistence mechanism, or operator-directed harm beyond the stated exploit is present.

ClassificationExploit

Model confidence98%

AuthenticationRequired

Languagespython

Target softwareGitLab CE/EE

Attack typesauthentication bypassprivilege escalationinformation disclosure

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script that actively triggers a vulnerability (CVE-2024-6678) to execute pipeline schedules as an arbitrary user, including optional steps to exfiltrate data and bypass protections. This constitutes exploit code.

CVE-2024-6678-poc.py:1CVE-2024-6678-poc.py:98-116CVE-2024-6678-poc.py:120-146CVE-2024-6678-poc.py:283-285

Requirements

Attacker must have a GitLab personal access token with Developer-level access to the target project.CVE-2024-6678-poc.py:289-290
Target project must have at least one active pipeline schedule.CVE-2024-6678-poc.py:353-357

Observed behavior

Authenticates to the GitLab instance using the provided token and retrieves the attacker's user ID and username.CVE-2024-6678-poc.py:343-350
Enumerates all pipeline schedules for the target project.CVE-2024-6678-poc.py:353-363
Selects a target schedule, preferring those owned by other users.CVE-2024-6678-poc.py:366-389
Triggers the selected pipeline schedule via the REST API or GraphQL mutation, causing the pipeline to run as the attacker instead of the schedule owner.CVE-2024-6678-poc.py:443-490
Optionally patches .gitlab-ci.yml on the target branch to exfiltrate all environment variables to an attacker-controlled URL.CVE-2024-6678-poc.py:202-210CVE-2024-6678-poc.py:431-441
Optionally performs a protected-ref bypass by creating a tag with the same name as a protected branch to circumvent branch protection policies.CVE-2024-6678-poc.py:153-195CVE-2024-6678-poc.py:408-424

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exfiltration Url Parameter: Payload withheldThe script accepts an attacker-controlled URL to receive exfiltrated CI variables, which is part of the documented exploit workflow.CVE-2024-6678-poc.py:295-296
Ci Yaml Patch: Payload withheldThe script temporarily replaces the CI configuration to dump environment variables to the attacker's URL, then attempts to restore the original file. This is part of the documented exploit.CVE-2024-6678-poc.py:202-276
Authentication Token Usage: Payload withheldThe script uses the provided token to authenticate API requests, which is necessary for the exploit.CVE-2024-6678-poc.py:289-290

Review boundaries

What the analysis did not establish

Evidence includes only two text files from the repository; other files, if any, were not provided.
The artifact's behavior is inferred from static analysis of the source code; the code was not executed.
The README.md file contains embedded images that are not rendered in the text evidence, limiting full understanding of the visual output.
Only the two text files (CVE-2024-6678-poc.py and README.md) were reviewed; no binary files were present.
The review does not assess whether the exploit actually works or is safe to execute.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub