How to exploit parser differentials

This post details a security vulnerability in GitLab's Conan package upload functionality. It explains how `gitlab-workhorse` and `gitlab-rails` parse HTTP requests differently, leading to a parser differential. An attacker could exploit this by sending a POST request with an overridden HTTP method (`X-HTTP-METHOD-OVERRIDE: PUT`) to `gitlab-rails`, bypassing `gitlab-workhorse`'s routing and potentially accessing arbitrary files from `/tmp` by manipulating the `file.path` parameter. The vulnerability was patched by implementing request signing in `gitlab-workhorse` and verification in `gitlab-rails`.