GitLab CE/EE GraphQL Multiplex IntroducedTracer CSRF Allowing Mutation Execution via GET

#!/usr/bin/env python3
"""CVE-2026-19650 detection — safe, non-destructive multiplex query-swap check.
Usage: python3 check_cve_2026_19650.py <GITLAB_BASE_URL>
Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
"""
import sys
import json
import urllib.request
import urllib.parse
import ssl

def main():
    if len(sys.argv) < 2:
        print("Usage: python3 check_cve_2026_19650.py <GITLAB_BASE_URL>")
        sys.exit(2)

    base_url = sys.argv[1].rstrip("/")

    # Two safe read-only queries with distinct return shapes.
    # On vulnerable instances, slot 0 returns slot 1's data (query-swap).
    query_a = '{"query": "query { currentUser { __typename } }"}'
    query_b = '{"query": "query { metadata { version } }"}'
    multiplex_payload = f"[{query_a}, {query_b}]"

    graphql_url = f"{base_url}/-/graphql"
    params = urllib.parse.urlencode({"_method": "GET", "operations": multiplex_payload})
    full_url = f"{graphql_url}?{params}"

    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    req = urllib.request.Request(full_url, method="GET")
    req.add_header("Accept", "application/json")
    req.add_header("User-Agent", "noisgate-cve-2026-19650-check/1.0")

    try:
        with urllib.request.urlopen(req, timeout=15, context=ctx) as resp:
            body = json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        if e.code == 400 or e.code == 422:
            # Multiplex GET rejected entirely — likely patched or hardened
            print("PATCHED — server rejected multiplex GET (HTTP {})".format(e.code))
            sys.exit(0)
        print(f"UNKNOWN — HTTP {e.code}: {e.reason}")
        sys.exit(2)
    except Exception as e:
        print(f"UNKNOWN — connection error: {e}")
        sys.exit(2)

    if not isinstance(body, list) or len(body) < 2:
        print("UNKNOWN — unexpected response shape (not a multiplex array)")
        sys.exit(2)

    slot0 = body[0].get("data", {})
    slot1 = body[1].get("data", {})

    # Check for query-swap: slot 0 should have currentUser, slot 1 should have metadata.
    # If slot 0 contains metadata keys, the swap occurred.
    slot0_has_metadata = "metadata" in slot0 or "version" in slot0
    slot0_has_user = "currentUser" in slot0
    slot1_has_metadata = "metadata" in slot1

    if slot0_has_metadata and not slot0_has_user:
        print("VULNERABLE — multiplex query-swap confirmed (slot 0 returned slot 1 data)")
        print(f"  slot 0 data: {json.dumps(slot0)}")
        print(f"  slot 1 data: {json.dumps(slot1)}")
        sys.exit(1)
    elif slot0_has_user and slot1_has_metadata:
        print("PATCHED — slots are properly isolated")
        print(f"  slot 0 data: {json.dumps(slot0)}")
        print(f"  slot 1 data: {json.dumps(slot1)}")
        sys.exit(0)
    else:
        print("UNKNOWN — could not determine swap behavior")
        print(f"  slot 0 data: {json.dumps(slot0)}")
        print(f"  slot 1 data: {json.dumps(slot1)}")
        sys.exit(2)

if __name__ == "__main__":
    main()