Researcher Publishes GitLab RCE PoC Allowing Authenticated Users to Run Commands
Working exploit code released for a GitLab vulnerability patched six weeks earlier.
1Critical RCE Vulnerability Discovered in GitLab
Researchers at depthfirst discovered a remote code execution (RCE) vulnerability in GitLab that allows authenticated users to execute commands. Although patched by GitLab on June 10, the flaw affects unpatched self-managed servers running version 18.11.3. The working exploit code was published on July 24. The vulnerability can be exploited by any authenticated user with push access to a project.
2How the Exploit Works
An attacker commits a crafted Jupyter notebook and views its commit diff to leak a heap pointer. With enough leaks, an automated probe can locate libraries in memory. Two additional notebooks then trigger the payload. The attack requires no admin rights, CI/runner access, victim interaction, or access to others' projects. The exploit leverages GitLab's notebook renderer, a gem called ipynbdiff.
3GitLab's Missing Security Classification
GitLab did not classify the fix as a security update. The Oj 3.17.3 update was listed under bug fixes in the June 10 patch release, not the security fixes table. Consequently, operators had no reason to prioritize this update. No CVE, CVSS score, or mention of the notebook-diff chain was provided.
4Underlying Oj JSON Parser Bugs
The vulnerability stems from two memory corruption bugs in Oj, a Ruby JSON parser written mostly in C. depthfirst's systems autonomously flagged these bugs, which researchers then manually chained. One bug overflows a fixed 1,024-byte nesting stack to control the parser's start callback. The other truncates a 65,565-byte object key to 29 bytes, returning a live heap pointer.
5Affected Versions and Mitigations
All GitLab tiers (CE and EE, Free through Ultimate) are affected, though Ruby itself is not. Oj 3.17.2 included other fixes from the same review but not these two. Users must upgrade to 18.10.8, 18.11.5, or 19.0.2. depthfirst offers no workaround for those unable to upgrade.
6Potential Impact of the Exploit
Commands execute as the git account behind Puma. What this account can access depends on installation isolation. Attackers may reach source code, Rails secrets, service credentials, CI/CD data, and internal services the app communicates with. depthfirst has observed no in-the-wild exploitation to date.
7Technical Details of the Exploit
The public exploit targets GitLab 18.11.3 on x86-64. Gadget offsets, register state, and jemalloc behavior were derived from this image. However, retargeting other GitLab builds on the same architecture typically requires only minor offset updates. Porting to ARM64 would demand significant changes. depthfound memory searches take 5-10 minutes on fresh installations.
8Significance and Implications
This vulnerability poses a severe security risk for GitLab users. Attackers can execute arbitrary code with authenticated user privileges. GitLab's failure to classify the fix as security-critical may lead operators to underestimate the risk. Immediate upgrades and security reviews are critically important for all affected installations.