DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted server

Summary

This report described a vulnerability in GitLab where an attacker could cause a server side denial of service by importing a malicious payload via the GitHub importer functionality.

More details can be found https://gitlab.com/gitlab-org/gitlab/-/issues/463092

When importing a project from Github (dotcom or GHES) server, Gitlab uses Octokit to fetch necessary infos (repo, contributors, pull requests, notes,...).

Under the hood, Octokit uses Sawyer as its hypermedia agent. Github API requests will return Sawyer::Resource objects. A Sawyer::Resource object is placeholder of around 10 nested Ruby objects (most of them are Ruby Hash objects). Parsing a 1MB data (response) into Sawyer::Resource objects results in allocating 250MB memory. Parsing some responses concurrently would cause OOM-killed to the Puma main process --> knocking down Gitlab web services. It takes around 2 minutes for the Puma main process and all workers to restart.

This is my first H1 report. I'd like to express my sincere gratitude to @h1_analyst_indy and @gmyers for your patience while dealing with me and my (many) wrong assumptions :v

Also thanks @ammar2 for below blog post about an issue that "allowed anyone to send certain malformed packets and crash a MineCraft server by running it out of memory". https://blog.ammaraskar.com/minecraft-vulnerability-advisory/