Security researcher Yuhang Wu at depthfirst has published a working proof-of-concept (PoC) exploit that executes commands as git on an unpatched self-managed GitLab 18.11.3 server.
The Vulnerability and Exploit
The public exploit is build-specific to GitLab 18.11.3 on x86-64; the underlying Oj bugs affect broader releases. The affected ranges are GitLab Community Edition (CE) and Enterprise Edition (EE) 15.2.0 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1. The first fixed releases are 18.10.8, 18.11.5, and 19.0.2.
Successful exploitation runs as git. Its effective reach depends on deployment isolation, but may include source code, Rails secrets, service credentials, CI/CD data, and internal services reachable from the application.
Technical Analysis
depthfirst's technical analysis shows how one bug controls a callback pointer, while the other leaks a heap address needed to narrow the address space layout randomization (ASLR) search. Oj stores nesting state in a fixed 1,024-byte stack but never checks whether the depth exceeds it. Deeply nested arrays can therefore write 0x01 bytes into adjacent parser state.
The exploit corrupts buf.head, causing Oj to pass a forged interior pointer to realloc(). A later Ruby Array allocation reclaims the same 3,584-byte jemalloc region and overwrites p->start.
Impact and Response
GitLab.com was patched by June 10. Dedicated customers need no action. Self-managed operators should move to a supported release containing the fix. Helm and Operator users need to check the GitLab version inside the Webservice image, not only the chart or Operator version.
depthfirst reported the Oj bugs on May 21, and the maintainer merged the fixes on May 27. Oj 3.17.3 shipped on June 4. The researchers reported the GitLab chain on June 5; depthfirst said GitLab confirmed it on June 8.
What this means for technologists and security teams, affected enterprises, and end users
Technologists and security teams will need to assess their GitLab deployments and apply patches to vulnerable versions. Affected enterprises should prioritize patching, as the exploit allows for remote code execution as the git user, potentially leading to significant compromise.
End users of GitLab, particularly those with self-managed instances, should ensure their administrators are aware of the vulnerability and take necessary actions to secure their systems.
Conclusion
The publication of this PoC exploit highlights the importance of keeping software up to date, particularly in the face of publicly known vulnerabilities. As of July 24, depthfirst was unaware of in-the-wild exploitation, but the availability of a working exploit increases the urgency for patching.
