Loading video...
Video Failed to Load
We successfully achieved an RCE on GitLab in its default configuration. Historically, most GitLab RCEs have lived in the web or application-logic layers. This time, guided by the depthfirst spirit, we went deeper: into the low-level gem dependency chain beneath GitLab. The result? By sending crafted JSON data, we... show more
102,624 views • 3 months ago •via X (Twitter)
17 Comments
GitLab OJ Spill overview: Technical details: Demo and PoC:
Incredible work @wupco1996 and team
@depthfirstlabs This is huge
@depthfirstlabs It's impressive that the @depthfirstlabs platform did exactly what it was designed to do. From finding a critical vulnerability in Oj to finding that it's exploitable in gitlab, which is used by many of the largest organizations on the planet.
@depthfirstlabs insane I can't wait to see what you publish next :)
@depthfirstlabs unstoppable
@depthfirstlabs absolutely insane work by the team
@depthfirstlabs wow!
@depthfirstlabs Did you guys defeat ASLR ?
@depthfirstlabs Nice! What's the CVE ID? GitLab's patch notes don't mention anything matching the description in your writeup (as far as I can tell), they simply link to the commit bumping oj's version.
@depthfirstlabs We did not request CVE identifiers. We reported the GitLab vulnerability to GitLab through its HackerOne vulnerability disclosure program. No separate CVE identifier was assigned to us for the GitLab-level exploit chain during that process.😂
@depthfirstlabs Thanks - do any of the oj CVEs you mentioned correspond to the exploit chain in GitLab? They shouldn't assign a separate CVE if the vulnerability stems from a dependency.
@depthfirstlabs Really impressive work 👏
@depthfirstlabs this is amazing!!
@depthfirstlabs Could u teach me plz, Master. Wu?
@chybeta @depthfirstlabs good job
@depthfirstlabs Wow 🙌
