TLDR Tech / InfoSec
Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities
An authenticated GitLab user with push access could chain two memory-safety bugs in the Oj JSON parser, an unchecked nesting-stack write and an unsafe 16-bit key-length truncation, by committing a crafted Jupyter notebook and viewing its rendered diff, since GitLab's in-tree ipynbdiff gem feeds repository-controlled bytes into Oj::Parser.usual.parse inside the Puma worker. The write primitive was amplified through a jemalloc allocator handoff and Ruby Array heap overlap to seize a parser callback pointer, while the key-length bug leaked a heap address through the rendered diff to defeat ASLR and pivot to system() via libruby/libc gadgets, executing commands as the git user. DepthFirst reported the bugs on June 5, and GitLab shipped fixed Oj 3.17.3 in its June 10 releases. The same audit surfaced nine further Oj CVEs across its dump, loader, and document APIs. Self-managed operators should upgrade to a current supported GitLab patch release and confirm their deployment bundles Oj 3.17.3 or later, since versions 15.2 through 18.9 outside GitLab's security-maintained patch trains received no dedicated backport.
Read the full story