Researchers Publish GitLab RCE Exploit for Patched Oj Flaw
Summary
depthfirst published a working exploit for a patched GitLab flaw that lets authenticated users with project push access run commands as git on unpatched self-managed instances. The chain abuses two Oj parser memory-corruption bugs.
Key points
- depthfirst published working exploit code on July 24 for a GitLab flaw patched on June 10.
- An authenticated user with project push access can trigger the exploit by committing a crafted Jupyter notebook and opening its diff.
- Two Oj parser memory-corruption bugs let the chain leak a heap pointer, locate libc, and redirect execution to system().
- Commands run as the git account in a Puma worker; potential access to other resources depends on the installation’s isolation.
- Affected GitLab releases are patched in 18.10.8, 18.11.5, and 19.0.2; older 15.2–18.9 installations must move to a supported release.
- GitLab listed the Oj update as a bug fix rather than a security fix; the flaw has no CVE or CVSS score in the article.
- depthfirst says it is unaware of in-the-wild exploitation; the article reports that GitLab independently reproduced the RCE.
Article Details
- Attack Vectors
- An authenticated user with push access commits a crafted Jupyter notebook and opens its commit diff, causing GitLab's notebook renderer to pass attacker-controlled JSON to Oj::Parser.usual.parse.
- The exploit chain uses two Oj memory-corruption bugs: one can overwrite the parser's start callback, and the other leaks a heap pointer. The leak helps locate libc, enabling the callback to be redirected to system() and commands to run as the git account.
- Defensive Notes
- Upgrade GitLab CE/EE to 18.10.8, 18.11.5, or 19.0.2, as applicable. The article reports no workaround for installations that cannot upgrade.
- Verify the GitLab version inside the Webservice image running Puma; Helm chart or Operator versions do not establish whether the affected GitLab version is patched.
- Installations on versions 15.2 through 18.9 receive no backport, according to the article, and must move to a supported release.
- The article reports no known in-the-wild exploitation, but says commands run as git could reach source code, Rails secrets, service credentials, CI/CD data, and internal services, depending on isolation.