GitLab fixes critical vulnerability, patch now! (CVE-2023-5009)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-23521 +1 in the same advisory: …41903 | Git is distributed revision control system. Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue. NVD description · AI analysis pending | 9.8 | 56% |
| — | ||
| CVE-2023-3932 | An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. NVD description · AI analysis pending | 6.5 | <1% | PoC |
| — | |
| CVE-2023-5009 | An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. This was a bypass of [CVE-2023-3932](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3932) showing additional impact. NVD description · AI analysis pending | 9.8 | 8% |
| — |
Full article335 words · extracted from helpnetsecurity.com · click to collapse
GitLab has fixed a critical vulnerability (CVE-2023-5009) in the Enterprise Edition (EE) and Community Edition (CE) of its widely used DevOps platform. The flaw may allow a threat actor to abuse scan execution policies to run pipelines as another user.
About the vulnerability (CVE-2023-5009)
CVE-2023-5009 – discovered by software developer and bug hunter Johan Carlsson (joaxcar) in GitLab EE – affects all versions starting from 13.12 before 16.2.7 and all versions starting from 16.3 before 16.3.4, IF the “direct transfers” and “security policies” features are enabled at the same time.
“Scan execution policy allows configuring built-in scanners for GitLab projects, such as static analysis and vulnerability scanning. These scanners are running in dedicated pipelines with a predefined set of permissions,” Alex Ilgayev, head of security research at Cycode told Help Net Security.
The vulnerability is a bypass to another vulnerability (CVE-2023-3932) reported and fixed one month ago.
“According to the GitLab issue tracker and source code, any user can easily exploit that vulnerability by changing the policy file author using the ‘git config’ command. The scan is done through the identity of the policy file’s last committer, effectively gaining the permissions of arbitrary users,” Ilgayev added.
“Since then, GitLab updated the mechanism to execute these security scans using a dedicated bot user with limited permissions. While GitLab didn’t release official information regarding the bypass, by inspecting the GitLab source code, the bypass seems to involve removing the bot user from the group and allowing the execution of the previous vulnerability flow again.”
Mitigation
GitLab has released fixed versions for GitLab Community Edition (CE) and Enterprise Edition (EE).
“We strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version,” said Nick Malcolm, senior application security engineer at GitLab.
If an upgrade is impossible, Malcolm advised disabling the “direct transfers” or “security policies” feature (or both).
Earlier this year, GitLab addressed security issues CVE-2022-41903 and CVE-2022-23521 in Git that affected its Community Edition and Enterprise Edition.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/09/22/cve-2023-5009/