GitLab RCE PoC Published by Researcher

Security researcher Yuhang Wu, associated with depthfirst, published a proof-of-concept (PoC) exploit on October 26, 2024, demonstrating a remote code execution (RCE) vulnerability in self-managed GitLab instances. The exploit targets unpatched versions, specifically affecting GitLab 18.11.3.

This vulnerability allows an ordinary authenticated user to execute arbitrary commands on the server. The attack chain is initiated by committing two specially crafted Jupyter notebooks and then requesting a comparison (diff) of these notebooks. This process does not require administrator privileges or access to a continuous integration (CI) runner, and crucially, it does not necessitate any interaction from a victim.

Successful exploitation results in the execution of commands with the privileges of the 'git' user. This could allow an attacker to gain a foothold within the GitLab server environment, potentially leading to further compromise of the system or sensitive data. The PoC's availability highlights the urgency for administrators to apply the latest security patches to their self-managed GitLab deployments to mitigate this risk. The researcher has not yet disclosed specific mitigation steps beyond patching.