Threat Intelligence Brief
Curated summary with source attribution
Source: linkedin.com
Threat Risk: High
Victim: Self-managed GitLab installations
Incident: Remote code execution vulnerability via a flaw in the Oj JSON library.
Impact: Complete compromise of the underlying server running GitLab via the git service account.
Attacker: Authenticated users with project commit permissions
Analysis: The vulnerability stems from a memory-corruption chain in the Oj library used by GitLab for JSON processing. Attackers can trigger RCE by crafting a malicious Jupyter Notebook file and inducing the server to render the diff. This allows command execution under the git service account without requiring administrative privileges.
Recommendations: Update self-managed GitLab instances to the latest supported version containing Oj 3.17.3 or later.; Restrict project creation and commit permissions to trusted users to limit the attack surface.; Audit GitLab logs for unusual activity related to Jupyter Notebook rendering or unauthorized system commands.
Source: depthfirst
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source