On July 24, a researcher from depthfirst released proof-of-concept (PoC) exploit code for a vulnerability in GitLab, which was patched six weeks earlier on June 10. This vulnerability allows authenticated users to run commands as the ‘git’ user on any self-managed GitLab server running version 18.11.3 that has not applied the update.
The exploit can be executed by any authenticated user with permission to push to a project. The attacker commits a specially crafted Jupyter notebook, which when viewed, leaks a heap pointer. By utilizing multiple notebooks, an automated probe can identify libraries in memory, ultimately allowing the execution of commands.
Details of the Vulnerability
The vulnerability arises from two memory corruption bugs in the Oj gem, a Ruby JSON parser implemented primarily in C. The first bug allows writing past a fixed stack size, while the second bug truncates object keys and leaks a live heap pointer. This leak enables the attacker to locate critical memory addresses, facilitating command execution.
Impact and Affected Versions
All tiers of GitLab, including Community Edition (CE) and Enterprise Edition (EE), are affected by this vulnerability. Specifically, the following versions are impacted:
GitLab CE/EE: 15.2.0 to 18.10.7, 18.11.0 to 18.11.4, 19.0.0 to 19.0.1
Oj gem: 3.13.0 to 3.17.2
Users are advised to upgrade to GitLab versions 18.10.8, 18.11.5, or 19.0.2 to mitigate the risk.
Response and Future Considerations
Notably, GitLab did not classify the fix as a security issue, and there is currently no CVE assigned to this vulnerability. The lack of urgency in the patching process may lead to unawareness among operators who rely on the security fix table. Depthfirst has indicated that they are not aware of any in-the-wild exploitation of this vulnerability.
Depthfirst reported the Oj bugs on May 21, and the fixes were merged by the maintainer on May 27, with Oj 3.17.3 released on June 4. GitLab confirmed the exploit on June 8 and issued the patch on June 10. The researcher has also noted that while the exploit is tailored for GitLab 18.11.3 on x86-64 architecture, adapting it for other targets may require significant effort.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
