A recent security vulnerability has surfaced involving the popular GitLab platform, where an authenticated user can exploit a remote code execution (RCE) flaw to execute commands as the ‘git’ user. Security researcher Yuhang Wu from depthfirst has developed a proof-of-concept (PoC) to demonstrate this vulnerability on a self-managed GitLab 18.11.3 server.
Details of the Vulnerability
The vulnerability allows any authenticated user to execute commands by committing two specially crafted Jupyter notebooks and requesting their differences. Notably, this exploit does not require administrative privileges, access to continuous integration (CI) runners, or interaction with another user’s project.
The proof-of-concept is specifically tailored for GitLab 18.11.3 on x86-64 architecture, though the underlying issues could affect a broader range of versions. The affected versions include GitLab Community Edition (CE) and Enterprise Edition (EE) from 15.2.0 to 18.10.7, 18.11.0 to 18.11.4, and 19.0.0 to 19.0.1.
Patch Availability and Recommendations
GitLab has addressed these vulnerabilities in versions 18.10.8, 18.11.5, and 19.0.2. The flaw is linked to Oj, a high-performance JSON parser for Ruby, which affected versions 3.13.0 to 3.17.1. The first secure version is 3.17.3, which includes necessary fixes. Although Ruby remains unaffected, users are encouraged to upgrade to prevent potential exploitation.
Exploitation of this flaw can lead to significant unauthorized access, potentially exposing source code, service credentials, and sensitive data within CI/CD pipelines. GitLab.com implemented the patch by June 10, ensuring its users’ security. However, operators of self-managed instances need to update to a supported release to mitigate risks.
Technical Insights and Analysis
In-depth technical analysis by depthfirst reveals how the vulnerability manipulates GitLab’s notebook renderer. It utilizes attacker-controlled notebook data parsed by Oj::Parser.usual.parse, leading to control over a callback pointer and leaking a heap address essential for narrowing the address space layout randomization (ASLR) search.
The exploit involves deeply nested arrays that overflow the parser’s fixed stack, corrupting the internal parser state. This corruption allows the exploit to forge a pointer, ultimately executing system commands through a specific sequence of operations in GitLab’s environment.
depthfirst reported the Oj bugs on May 21, leading to a merge of fixes by May 27. Oj version 3.17.3 was released on June 4, with GitLab confirming the report by June 8. The patched versions were rolled out on June 10, with the report resolved by July 17.
To ensure security, self-managed GitLab operators must upgrade to the latest patched versions. Additionally, users utilizing Helm or Operator must verify the version within the Webservice image, not just the chart or Operator version.
