Remote Code Execution in GitLab via Ruby vulnerabilities

The research shows how a chain of two memory-corruption vulnerabilities in the Oj library (Ruby's JSON parser) leads to remote code execution in GitLab. An attacker can upload a specially crafted .ipynb file that first discloses memory addresses and then uses an overflow to overwrite a callback and gain code execution in the Puma process.

Exploitation requires only ordinary user privileges: an attacker simply needs to push the file and open the diff. The vulnerabilities have no critical impact individually, but together they enable full compromise of the GitLab server, including access to source code and CI/CD tokens — yet the fix was released as a routine bugfix without a separate CVE.

Article: https://depthfirst.com/research/going-depthfirst-achieving-gitlab-rce-via-two-ruby-memory-corruption-vulnerabilities