Collected research
Devfile file write vulnerability in GitLab
A walkthrough of CVE-2024-0402, an arbitrary file write in GitLab. GitLab's Ruby validation blocks the devfile 'parent' key, but a YAML parser differential smuggles it through: the local '!binary' tag decodes to a binary key in Ruby yet is silently dropped by Go's yaml.v3, leaving a key literally named 'parent'. The parent-from-registry path then extracts a tar archive whose entry names contain '../', which Go's filepath.Clean leaves relative, giving arbitrary file write and thus RCE.
Record
- Researcher
- joern
- Published by
- gitlab-com.gitlab.io
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of joern, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .