wupco/gitlab-rce-demoSelf-contained demo for GitLab RCE exploiting two Ruby memory corruption bugs in the Oj parser through notebook diff rendering.
This repository contains a self-contained demo for the GitLab notebook-diff RCE chain described in our research. It starts a fresh GitLab 18.11.3 container, creates an ordinary user through the public HTTP interface, and runs the PoC against that instance.
Technical details: Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities
amd64)First, build a fresh GitLab environment:
./setup_env.sh
This removes the previous demo container and its volumes, starts GitLab, waits for it to become ready, and provisions a normal user. A fresh GitLab boot can take several minutes.
Open two terminals. Start the callback listener in the first:
./run_poc.sh listen 4555
Run the exploit in the second:
./run_poc.sh exploit 4555
When the callback arrives, switch to the listener terminal and run commands such as id or whoami. The ASLR search time varies between runs.
GitLab renders Jupyter notebook diffs by passing repository-controlled JSON to Oj, a native Ruby JSON parser. The chain combines two parser bugs: one corrupts parser state and eventually controls a callback pointer, while the other discloses a heap pointer used to narrow the ASLR search. The PoC loads a precomputed lookup table, finds the matching library layout through normal GitLab HTTP requests, and makes the Puma worker connect back to the listener as the git user.
Use this demo only in the included local lab environment.