Safety researchers at depthfirst printed working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs instructions as git on any self-managed 18.11.3 server that has not taken the replace.
Any authenticated consumer who can push to a challenge can run it. The attacker commits a crafted Jupyter pocket book and opens its commit diff, which leaks a heap pointer. Sufficient of these and an automatic probe can find the libraries in reminiscence. Two extra notebooks then fireplace the payload. No administrator rights, no CI or runner entry, no sufferer interplay, no entry to anybody else’s challenge.
GitLab didn’t file the repair as a safety repair. A overview by The Hacker Information discovered the Oj 3.17.3 bump listed underneath bug fixes within the June 10 patch launch, not within the security-fix desk. There isn’t any CVE, no CVSS rating, and no point out of the notebook-diff chain. Operators who triaged that launch in opposition to the safety desk had no motive to deal with it as pressing.
Two reminiscence corruption bugs in Oj, a Ruby JSON parser applied largely in native C, make the chain work. depthfirst says its system flagged them autonomously, and researchers chained them by hand.
GitLab’s pocket book renderer, an in-tree gem referred to as ipynbdiff, passes repository-controlled .ipynb JSON to Oj::Parser.traditional.parse inside a long-lived Puma employee, so attacker-controlled bytes attain Oj’s manually managed C reminiscence inside the appliance course of.
One bug writes previous a set 1,024-byte nesting stack till it controls the parser’s begin callback. The opposite truncates a 65,565-byte object key to 29 in a signed 16-bit discipline and returns a dwell heap pointer, which GitLab renders into the diff. The leak locates libc, and the write factors the callback at system().
| Part | Affected | First fastened |
|---|---|---|
| GitLab CE/EE | 15.2.0 to 18.10.7 | 18.10.8 |
| GitLab CE/EE | 18.11.0 to 18.11.4 | 18.11.5 |
| GitLab CE/EE | 19.0.0 to 19.0.1 | 19.0.2 |
| Oj gem | 3.13.0 to three.17.1 | 3.17.3 |
All tiers are affected, CE and EE, Free by Final. Ruby itself isn’t. Oj 3.17.2 carried different fixes from the identical overview however not these two.
Improve to 18.10.8, 18.11.5, or 19.0.2. Neither GitLab nor depthfirst gives a workaround for anybody who can’t.
The lure is Helm and Operator: examine the GitLab model contained in the Webservice picture operating Puma, not the chart or Operator model. Something on 15.2 by 18.9 will get no backport, as a result of these traces sit outdoors GitLab’s security-maintained patch trains, so these installs have to maneuver to a supported launch as an alternative.
Instructions run as git, the account behind Puma. How far that goes is dependent upon how the set up is remoted. In attain: supply code, Rails secrets and techniques, service credentials, CI/CD information, and inner providers the appliance can speak to.
The general public exploit is constructed for GitLab 18.11.3 on x86-64. Gadget offsets, register state, and jemalloc habits all got here from that picture, and a recovered library base holds solely till the Puma grasp restarts, so this isn’t drop-in in opposition to an arbitrary goal.
The Oj bugs are common; porting the exploit is actual work. depthfirst measured 5 to 10 minutes for the reminiscence search on a contemporary two-worker set up and tasks one to 2 hours on longer-running ones. Its writeup has the total chain.
depthfirst reported the Oj bugs on Could 21, the maintainer merged fixes on Could 27, and Oj 3.17.3 shipped June 4. The GitLab chain went to GitLab on June 5, was confirmed on June 8, and was patched on June 10. depthfirst says it’s not conscious of in-the-wild exploitation, and that GitLab reproduced the RCE independently. Its wider Oj overview produced 9 extra CVE advisories, none of them this chain.
The Hacker Information has requested GitLab why the repair was not categorized as a safety situation and whether or not a CVE will probably be assigned, and requested depthfirst about exploit portability. Responses are pending.
