2026年7月25日 4:34 ET 发布 · 更新于 4 个月前 · 1 个来源
Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
The Hacker News
·
原始报道
Security researcher Yuhang Wu at depthfirst has published a working proof-of-concept (PoC) exploit that executes commands as git on an unpatched self-managed GitLab 18.11.3 server. An ordinary authenticated user triggers it by committing two crafted Jupyter notebooks and requesting their diff. The chain needs no administrator rights, continuous integration (CI) runner access, victim interaction
原文