Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
Security researchers at depthfirst published a working Proof of Concept (PoC) for a Remote Code Execution (RCE) vulnerability in GitLab, affecting self-managed instances that have not applied recent patches. The exploit allows any authenticated user with push access to execute commands as the `git` user by chaining two memory corruption bugs in the Oj Ruby JSON parser gem. GitLab patched the underlying Oj dependency in June but failed to classify it as a security fix, leading to many administrat
Analysis
TL;DR
- Security researchers at depthfirst published a working Proof of Concept (PoC) for a Remote Code Execution (RCE) vulnerability in GitLab, affecting self-managed instances that have not applied recent patches.
- The exploit allows any authenticated user with push access to execute commands as the
gituser by chaining two memory corruption bugs in the Oj Ruby JSON parser gem. - GitLab patched the underlying Oj dependency in June but failed to classify it as a security fix, leading to many administrators missing the urgency of the update.
- The attack vector involves leaking heap pointers via crafted Jupyter notebook diffs to locate libraries in memory, followed by triggering the payload without requiring administrator rights or CI/runner access.
Why It Matters
This incident highlights critical risks in supply chain dependencies and patch management processes within DevOps platforms. It demonstrates how seemingly minor library updates can mask severe security vulnerabilities if not properly classified and communicated, potentially leaving organizations exposed to unauthorized code execution.
Technical Details
- Vulnerability Chain: The RCE exploits two memory corruption bugs in Oj (versions 3.13.0 to 3.17.1), a native C implementation of a Ruby JSON parser. One bug allows writing past a fixed nesting stack to control the parser's start callback, while the other truncates an object key to leak a live heap pointer.
- Exploitation Mechanism: Attackers commit a crafted Jupyter notebook (
ipynb) which triggers the renderer (ipynbdiff). Opening the commit diff leaks the heap pointer, allowing the attacker to locate libc and other libraries in memory. Subsequent notebooks fire the payload, pointing the callback tosystem(). - Affected Components: All GitLab CE/EE tiers (Free through Ultimate) are affected. Specifically, versions 15.2.0–18.10.7, 18.11.0–18.11.4, and 19.0.0–19.0.1 are vulnerable. The Oj gem versions 3.13.0–3.17.1 contain the flaws.
- Patch Status: GitLab released fixes on June 10 (18.10.8, 18.11.5, 19.0.2) and Oj released 3.17.3 on June 4. However, GitLab listed the Oj bump under "bug fixes" rather than security advisories, causing confusion. No CVE was initially assigned.
- Privileges and Impact: The exploit runs commands as the
gituser (the account behind the Puma worker). This grants access to source code, Rails secrets, service credentials, CI/CD data, and internal services reachable by the application.
Industry Insight
- Patch Classification Rigor: Organizations must scrutinize all dependency updates, even those labeled as "bug fixes," for potential security implications. Automated monitoring should flag updates to critical components like JSON parsers regardless of their classification in release notes.
- Dependency Hygiene: Regular audits of third-party gems and native libraries are essential. The Oj vulnerability underscores the need to ensure that downstream applications using vulnerable libraries are updated promptly, independent of the primary platform's security advisory timeline.
- Isolation Strategies: Since the exploit runs as the
gituser, robust containerization and strict filesystem permissions are vital. Minimizing the blast radius of the application process can limit the impact of such RCEs, protecting sensitive secrets and internal services.
Disclaimer: The above content is generated by AI and is for reference only.