How to exploit parser differentials

What this post added

This post details a security vulnerability discovered in GitLab's file upload handling, specifically concerning Conan packages. It explains how a parser differential between gitlab-workhorse and gitlab-rails, combined with Rack::MethodOverride, could be exploited to bypass gitlab-workhorse and access arbitrary files on the server. The post outlines the technical details of the exploit, including the modified PUT/POST requests and the role of `file.path`. The fix involved implementing request signing in gitlab-workhorse and verifying it in gitlab-rails.