正在加载视频...

视频加载失败

加载此视频时出现问题。这可能是由于临时网络问题，或视频可能不可用。

We successfully achieved an RCE on GitLab in its default configuration. Historically, most GitLab RCEs have lived in the web or application-logic layers. This time, guided by the depthfirst spirit, we went deeper: into the low-level gem dependency chain beneath GitLab. The result? By sending crafted JSON data, we... show more

Yuhang Wu

1,491 subscribers

102,624 次观看 • 3 个月前 •via X (Twitter)

Anya Rossi• Live Now

Private livecam show

17 条评论

Yuhang Wu 的头像

Yuhang Wu3 个月前

GitLab OJ Spill overview: Technical details: Demo and PoC:

depthfirst 的头像

depthfirst3 个月前

Incredible work @wupco1996 and team

Francesco Piccoli 的头像

Francesco Piccoli3 个月前

@depthfirstlabs This is huge

QM 的头像

QM3 个月前

@depthfirstlabs It's impressive that the @depthfirstlabs platform did exactly what it was designed to do. From finding a critical vulnerability in Oj to finding that it's exploitable in gitlab, which is used by many of the largest organizations on the planet.

Federico 的头像

Federico3 个月前

@depthfirstlabs insane I can't wait to see what you publish next :)

Yueqi Chen 的头像

Yueqi Chen3 个月前

@depthfirstlabs unstoppable

STJ 的头像

STJ3 个月前

@depthfirstlabs absolutely insane work by the team

Adam 的头像

Adam3 个月前

@depthfirstlabs wow!

Quang Vo 的头像

Quang Vo3 个月前

@depthfirstlabs Did you guys defeat ASLR ?

Amitai Cohen 的头像

Amitai Cohen3 个月前

@depthfirstlabs Nice! What's the CVE ID? GitLab's patch notes don't mention anything matching the description in your writeup (as far as I can tell), they simply link to the commit bumping oj's version.

Yuhang Wu 的头像

Yuhang Wu3 个月前

@depthfirstlabs We did not request CVE identifiers. We reported the GitLab vulnerability to GitLab through its HackerOne vulnerability disclosure program. No separate CVE identifier was assigned to us for the GitLab-level exploit chain during that process.😂

Amitai Cohen 的头像

Amitai Cohen3 个月前

@depthfirstlabs Thanks - do any of the oj CVEs you mentioned correspond to the exploit chain in GitLab? They shouldn't assign a separate CVE if the vulnerability stems from a dependency.

steve 的头像

steve3 个月前

@depthfirstlabs Really impressive work 👏

Tanmay Gupta 的头像

Tanmay Gupta3 个月前

@depthfirstlabs this is amazing!!

Zeddy 的头像

Zeddy3 个月前

@depthfirstlabs Could u teach me plz, Master. Wu?

sanzhang 的头像

sanzhang3 个月前

@chybeta @depthfirstlabs good job

Staatse 的头像

Staatse3 个月前

@depthfirstlabs Wow 🙌

相关视频

GitLab is now available in Stripe Projects. Developers and AI coding agents can add GitLab to a new project in seconds, with credentials and environment variables handled automatically. Run "stripe projects add gitlab/project" to get started. Learn more:

GitLab is now available in Stripe Projects. Developers and AI coding agents can add GitLab to a new project in seconds, with credentials and environment variables handled automatically. Run "stripe projects add gitlab/project" to get started. Learn more:

🦊 GitLab

14,282 次观看 • 6 个月前

Checkout our new blogpost! In this post we talk about SAML and the recent Ruby-SAML Auth bypass. CVE-2024-45409: Ruby-SAML Auth Bypass in GitLab

Checkout our new blogpost! In this post we talk about SAML and the recent Ruby-SAML Auth bypass. CVE-2024-45409: Ruby-SAML Auth Bypass in GitLab

HTTPVoid

40,216 次观看 • 2 年前

GitLab Orbit, now in public beta, is the context graph for the entire software lifecycle. It continuously maps code, work items, pipelines, deployments, and production signals into a single live graph, so agents reason from first-party context instead of fragmented signals.

GitLab Orbit, now in public beta, is the context graph for the entire software lifecycle. It continuously maps code, work items, pipelines, deployments, and production signals into a single live graph, so agents reason from first-party context instead of fragmented signals.

🦊 GitLab

17,876 次观看 • 4 个月前

GitLab Artifact Central lets platform teams assemble the right software the first time. It brings containers and packages into one control plane alongside source code management and CI pipelines. Teams can set policy once at the organization level, instantly answer what was published, and realize up to 50% lower total cost of ownership compared with alternative tooling. Learn more:

GitLab Artifact Central lets platform teams assemble the right software the first time. It brings containers and packages into one control plane alongside source code management and CI pipelines. Teams can set policy once at the organization level, instantly answer what was published, and realize up to 50% lower total cost of ownership compared with alternative tooling. Learn more:

🦊 GitLab

673,003 次观看 • 20 天前

11 years of contributions in less than 30 seconds. A big thank you to everyone who has made contributions to GitLab over the years. Also a thanks to Andrew for Gource, creating this visualization.

11 years of contributions in less than 30 seconds. A big thank you to everyone who has made contributions to GitLab over the years. Also a thanks to Andrew for Gource, creating this visualization.

🦊 GitLab

192,020 次观看 • 3 年前

If your issue backlog feels personal… it’s probably because you’re the one triaging it. GitLab Duo Agent Platform can: • Read every issue (not just the title) • Flag missing details • Loop in the right teammate • Triage your entire backlog at once. Hundreds of issues. Over a day saved. Let’s flow with Duo!

If your issue backlog feels personal… it’s probably because you’re the one triaging it. GitLab Duo Agent Platform can: • Read every issue (not just the title) • Flag missing details • Loop in the right teammate • Triage your entire backlog at once. Hundreds of issues. Over a day saved. Let’s flow with Duo!

🦊 GitLab

13,056 次观看 • 8 个月前

"You could have a situation where the model understands what chain of thought is and that people are observing it. This is all in the pre-training data." “One of the major takeaways from the incident is that people underestimated the AI. And we never want to be in a situation again where we underestimate the AI.” "Things like chain of thought monitoring buy us time, and they can tell us if we're on the right path. But at the end of the day, we really do need to solve the alignment problem." Noam Brown

"You could have a situation where the model understands what chain of thought is and that people are observing it. This is all in the pre-training data." “One of the major takeaways from the incident is that people underestimated the AI. And we never want to be in a situation again where we underestimate the AI.” "Things like chain of thought monitoring buy us time, and they can tell us if we're on the right path. But at the end of the day, we really do need to solve the alignment problem." Noam Brown

Dwarkesh Patel

135,228 次观看 • 1 个月前

We have the tools and you have the talent. Together, we level up in 2025! Application link in bio. #lwtsquad

We have the tools and you have the talent. Together, we level up in 2025! Application link in bio. #lwtsquad

LWT

27,421 次观看 • 1 年前

I have spent the last 11 years building in this industry but 2025 was by far the most exciting. My last video of the year with some reflections on everything we accomplished together with the ZIG Chain community, and whats ahead in 2026 👇

I have spent the last 11 years building in this industry but 2025 was by far the most exciting. My last video of the year with some reflections on everything we accomplished together with the ZIG Chain community, and whats ahead in 2026 👇

Abdul Rafay Gadit

110,968 次观看 • 9 个月前

View and manage issues, merge requests, pipelines, and repositories with the GitLab plugin.

View and manage issues, merge requests, pipelines, and repositories with the GitLab plugin.

Cursor

18,125 次观看 • 7 个月前

Almost 1 year with an impenetrable vision, we want to show you in this video a small summary of what we have lived inside the server with more members. #WEAREELITE and if you would like to join us and meet us, you can find the application link here

Almost 1 year with an impenetrable vision, we want to show you in this video a small summary of what we have lived inside the server with more members. #WEAREELITE and if you would like to join us and meet us, you can find the application link here

Élite

21,754 次观看 • 3 年前

Claude Code now runs in GitLab CI/CD pipelines 🚀 Tag @ Claude in issues or merge requests to run automated coding tasks in secure containers, with all changes following your branch protection and review workflows. ✅ Available via the Anthropic API, Amazon Bedrock, and Google Vertex AI ✅ Customize Claude Code for your codebase by adding a file to your repository root ✅ Delegate code reviews, bug fixes, and implementation plans to complete routine tasks asynchronously Get started with Claude Code in GitLab:

Claude Code now runs in GitLab CI/CD pipelines 🚀 Tag @ Claude in issues or merge requests to run automated coding tasks in secure containers, with all changes following your branch protection and review workflows. ✅ Available via the Anthropic API, Amazon Bedrock, and Google Vertex AI ✅ Customize Claude Code for your codebase by adding a file to your repository root ✅ Delegate code reviews, bug fixes, and implementation plans to complete routine tasks asynchronously Get started with Claude Code in GitLab:

🦊 GitLab

33,641 次观看 • 1 年前

Andy Burnham: Brexit hasn’t given us control. We’ve lost some of the control we had over our economy, as a decade of low growth has put us in a weaker position. And we’ve lost some of our control over immigration. At its most fundamental level, this is a debate about fairness, so I understand the anger about what’s happening in the Channel.

Andy Burnham: Brexit hasn’t given us control. We’ve lost some of the control we had over our economy, as a decade of low growth has put us in a weaker position. And we’ve lost some of our control over immigration. At its most fundamental level, this is a debate about fairness, so I understand the anger about what’s happening in the Channel.

Clash Report

13,426 次观看 • 27 天前

The house of the Lord is where we can be transformed in higher and holier ways. So when we walk out of the temple, transformed by our hope in the promises of the covenants, armed with power from on high, we take the temple with us into our homes and lives. I assure you that having the Spirit of the Lord’s house in us changes us completely. #GeneralConference

The house of the Lord is where we can be transformed in higher and holier ways. So when we walk out of the temple, transformed by our hope in the promises of the covenants, armed with power from on high, we take the temple with us into our homes and lives. I assure you that having the Spirit of the Lord’s house in us changes us completely. #GeneralConference

Ulisses Soares

27,125 次观看 • 2 年前

High-level forces need a high-level communications system to execute on marketing and coordinate objectives. Creating jobs for other human beings is amongst the best things you can do as a person on this planet. Now we have an interface to power this process for our community, powered by Robinhood Chain and payable in Stock Tokens. Naturally, L.A.U.R.A has entered as the moderator of Pager. Long term, I believe with the proper execution we can turn 'Pager' into a crypto-powered encrypted messaging IOS and Android communication application and jobs platform powered by Robinhood Chain. check out the video below.

High-level forces need a high-level communications system to execute on marketing and coordinate objectives. Creating jobs for other human beings is amongst the best things you can do as a person on this planet. Now we have an interface to power this process for our community, powered by Robinhood Chain and payable in Stock Tokens. Naturally, L.A.U.R.A has entered as the moderator of Pager. Long term, I believe with the proper execution we can turn 'Pager' into a crypto-powered encrypted messaging IOS and Android communication application and jobs platform powered by Robinhood Chain. check out the video below.

SimpleFarmer

19,992 次观看 • 1 个月前

Web3 belongs in the mainstream. Bill Laboon | Web3 Foundation joined Good Morning Britain Good Morning Britain yesterday to discuss our latest research on privacy, data, and the everyday internet. This is the work we love! We take the ideas behind Web3 beyond our industry and into the conversations shaping how people think about the future of the web.

Web3 belongs in the mainstream. Bill Laboon | Web3 Foundation joined Good Morning Britain Good Morning Britain yesterday to discuss our latest research on privacy, data, and the everyday internet. This is the work we love! We take the ideas behind Web3 beyond our industry and into the conversations shaping how people think about the future of the web.

Web3 Foundation

48,009 次观看 • 27 天前

#WATCH | On India's position in the West Asia conflict, former R&AW Chief Vikram Sood, in an interview with ANI, says, "Israel is our friend. We have close ties; we are dependent on them for a lot of things which relate to our security... But this attack on Iran and the assassination or murder of the prior leader tantamounts to murder and a state taking the law into its own hands. This is followed up by Americans joining in the same thing in an undeclared war against a country... We won't say that Israel is not our friend, but we will say that this killing was unfortunate and could have been avoided. There is no other position we can take. We are dependent on the Strait (of Hormuz), not on Iran... We didn't bring it upon ourselves, nor did Iran bring it upon us. It was brought upon us because of the attacks by the Israelis and the Americans." Watch full interview here:

#WATCH | On India's position in the West Asia conflict, former R&AW Chief Vikram Sood, in an interview with ANI, says, "Israel is our friend. We have close ties; we are dependent on them for a lot of things which relate to our security... But this attack on Iran and the assassination or murder of the prior leader tantamounts to murder and a state taking the law into its own hands. This is followed up by Americans joining in the same thing in an undeclared war against a country... We won't say that Israel is not our friend, but we will say that this killing was unfortunate and could have been avoided. There is no other position we can take. We are dependent on the Strait (of Hormuz), not on Iran... We didn't bring it upon ourselves, nor did Iran bring it upon us. It was brought upon us because of the attacks by the Israelis and the Americans." Watch full interview here:

ANI

85,019 次观看 • 7 个月前