GitLab patches critical vulnerability

GitLab is warning users to patch GitLab Enterprise Edition instances against a critical vulnerability.

In its advisory, the organisation said the vulnerability, given the identifier CVE-2023-5009, allows an attacker to abuse the software’s scheduled security scan policies to “run pipelines as an arbitrary user”.

The vulnerability has a common vulnerabilities scoring system (CVSS) rating of 9.8.

An instance is vulnerable if it has two features enabled: direct transfers, and security policies.

Direct transfers is a feature that enables migration of groups and projects by direct transfer; while security policies supports scans running either to schedule, or within a project’s pipeline.

Users who can’t upgrade are urged to disable these features.

The vulnerability affect “all versions starting from 13.12 before 16.2.7 and all versions starting from 16.3 before 16.3.4”.

GitLab’s advisory noted that the bug arises from a bypass of a patch for a previous, nearly-identical vulnerability, CVE-2023-3932, which has a CVSS score of 6.5 and was patched in August.

The latest bug was reported via HackerOne by Johan Carlsson (joaxcar).

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts