Jang from STAR Labs walks through the post-auth RCE in GitLab’s project import (CVE-2022-2185, CVSS 9.9), from the initial advisory to a working PoC.
The root cause is DecompressedArchiveSizeValidator, which builds a gzip -dc <archive path> | wc -c shell command as a single string.
The attacker controls that path through the hidden Bulk Import feature by serving crafted project data from a GitLab instance of their own.
The original report by vakzz notes that the bulk_import_projects feature flag is disabled by default on self-managed instances, which shrinks the blast radius but is no excuse to skip 15.1.1, 15.0.4 or 14.10.5.
In late August GitLab fixed two more critical RCEs via GitHub import, a week apart.
