Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Self-managed GitLab CE/EE installations
Incident: Publication of a working PoC for a remote code execution vulnerability in GitLab’s notebook rendering process.
Impact: Full compromise of the GitLab application process, potentially exposing source code and service credentials.
Attacker: Authenticated users / Unidentified threat actors
Analysis: The flaw stems from a memory corruption bug in the Oj JSON parser used by GitLab’s notebook renderer. By committing specifically crafted Jupyter notebooks, an attacker can bypass ASLR and achieve remote code execution as the ‘git’ user. This attack requires no administrative privileges or victim interaction, making it a significant risk for self-managed instances.
Recommendations: Update self-managed GitLab instances to versions 18.10.8, 18.11.5, or 19.0.2 immediately.; Verify the Oj gem version within the Webservice image for Helm and Operator deployments.; Audit system logs for unusual commits of Jupyter notebooks (.ipynb files) from unexpected users.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source