GitLab fixed a critical zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-5356 | Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions s Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user. NVD description · AI analysis pending | 8.8 group max | <1% |
| — | ||
| CVE-2023-7028 | Unauthenticated Account Takeover via Password Reset Flaw in GitLab CE/EE GitLab Community and Enterprise Editions contain a critical improper access control flaw (CWE-640) in which password reset emails for a user account could be delivered to an unverified email address. Because the password reset flow is reachable over the network without authentication or user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N), an unauthenticated remote attacker could trigger a password reset for a victim's account such that the reset link lands on an attacker-controlled, unverified email address, then set a new password and hijack the account. Taking over an account gives the attacker that account's privileges, so compromise of an administrator account could expose the instance's code repositories, settings, and any secrets or CI/CD credentials they can reach. All GitLab CE/EE versions from 16.1 through 16.7 prior to the patched releases (16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, and 16.7.2) are affected. The flaw is under active exploitation: it carries an EPSS of 94.6% (100th percentile), was added to CISA's Known Exploited Vulnerabilities catalog on 2024-05-01, and news coverage confirms attackers are hijacking accounts in the wild. Do: Upgrade affected GitLab CE/EE instances immediately to the patched release for your track — 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, or 16.7.2 (or later) — prioritizing internet-facing instances given active exploitation and the KEV listing. Audit user accounts for unverified or unexpected email addresses and review logs for password reset activity to identify possible takeovers, and rotate credentials for any high-privilege accounts you suspect were compromised. | 9.8 | 95% | KEV PoC ×2 |
| largetens of thousands of internet-exposed GitLab instances (public internet-wide scan data) |
Full article366 words · extracted from securityaffairs.com · click to collapse
GitLab addressed two critical flaws impacting both the Community and Enterprise Edition, including a critical zero-click account hijacking vulnerability
GitLab has released security updates to address two critical vulnerabilities impacting both the Community and Enterprise Edition.
The most critical vulnerability, tracked as CVE-2023-7028 (CVSS score 10), is an account takeover via Password Reset. The flaw can be exploited to hijack an account without any interaction.
“An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.” reads the advisory published by GitLab.
The flaws impact the following versions:
- 16.1 prior to 16.1.5
- 16.2 prior to 16.2.8
- 16.3 prior to 16.3.6
- 16.4 prior to 16.4.4
- 16.5 prior to 16.5.6
- 16.6 prior to 16.6.4
- 16.7 prior to 16.7.2
The company is not aware of attacks in the wild exploiting the vulnerability CVE-2023-7028. Self-managed customers are recommended to review their logs to check for possible attempts to exploit this vulnerability:
- Check gitlab-rails/production_json.log for HTTP requests to the
/users/passwordpath with params.value.email consisting of a JSON array with multiple email addresses. - Check gitlab-rails/audit_json.log for entries with meta.caller.id of PasswordsController#create and target_details consisting of a JSON array with multiple email addresses.
The second vulnerability fixed by the company, tracked as CVE-2023-5356 (CVSS score 9.6) can be exploited by an attacker to abuse Slack/Mattermost integrations and execute slash commands as another user.
“Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse Slack/Mattermost integrations to execute slash commands as another user.” reads the advisory.
GitLab also addressed the following issues with the release of the version 16.7.2:
- CVE-2023-4812: Bypass CODEOWNERS approval removal.
- CVE-2023-6955: Improper access control for Workspaces.
- CVE-2023-2030: Commit signature validation ignores headers after signature.
The company urges organizations to update their installations immediately.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, GitLab)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/157389/security/gitlab-zero-click-account-hijacking-flaw.html