GitLab RCE via two memory corruption vulnerabilities in the Ruby Oj gem

Researchers at depthfirst demonstrated an RCE chain in GitLab through the processing of diffs for Jupyter Notebooks. A specially crafted .ipynb file is passed to ipynbdiff and then to the native Oj JSON parser, where the first vulnerability enables an out-of-bounds array write, while the second enables a heap address leak to bypass ASLR. As a result, an attacker can replace the parser callback and achieve execution of system() inside a Puma worker running as the git user.
The chain:
.ipynb in a Git repository → GitLab notebook diff → ipynbdiff → Oj C extension → OOB write → replacement of p->start → heap pointer leak → recovery of libc/libruby base → call to system()
The attack does not require administrator privileges, access to CI, or user interaction—it is sufficient to be able to push commits to a project and open the diff. GitLab CE/EE versions starting with 15.2.0 are affected. Fixes were included in 18.10.8, 18.11.5, and 19.0.2, while the secure version of Oj is 3.17.3.
Vendors
Gitlab
Depthfirst
Products
Gitlab Ce
Gitlab Ee
Ipynbdiff
Jupyter Notebooks
Oj
Puma
More