Advisory 2024-0070 - GitLab: Multiple Vulnerabilities

Notice: You can now also find information from the Vulnerability Advisory Service in the CTI portal!
The CTI portal is available at the following address: https://cti-portal.telekom.net/advisories/2024-0070

Notice: This advisory is by exception shown completely public. You will regularly receive details on vulnerability information as a customer via your login or through our daily advisory e-mail.

5	Attack probability high
4	Potential damage medium-high

Date: 2024-01-12
Release: 2024-01-12

Operating System

Linux
UNIX

Software

Open Source GitLab < 16.5.6
Open Source GitLab < 16.6.4
Open Source GitLab < 16.7.2

Attack

A remote attacker can exploit multiple vulnerabilities in GitLab in order to gain user privileges, manipulate data, and bypass security measures.

Description

GitLab is a web application for version management for software projects based on git.

CVE-2023-2030

There is a vulnerability in GitLab. An attacker can exploit this to modify the metadata of signed commits.

CVSSv2 Base Score: 6.6 / Temporal Score: 4.9
AV:N/AC:H/AU:S/C:C/I:C/A:N/E:U/RL:OF/RC:ND
CVSSv3.1 Base Score: 6.6 / Temporal Score: 5.8
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N/E:U/RL:O/RC:X

CVE-2023-4812

There is a vulnerability in GitLab. The required CODEOWNERS approval can be bypassed by adding changes to a previously approved merge request. An attacker can exploit this to bypass security mechanisms. Successful exploitation requires a user interaction.

CVSSv2 Base Score: 6.0 / Temporal Score: 4.4
AV:N/AC:M/AU:S/C:P/I:P/A:P/E:U/RL:OF/RC:ND
CVSSv3.1 Base Score: 7.6 / Temporal Score: 6.6
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N/E:U/RL:O/RC:X

CVE-2023-5356

A vulnerability exists in GitLab due to improper authorization checks regarding the Slack/Mattermost integration. An authenticated attacker can exploit this to execute "slash" commands as another user.

CVSSv2 Base Score: 6.5 / Temporal Score: 4.8
AV:N/AC:L/AU:S/C:P/I:P/A:P/E:U/RL:OF/RC:ND
CVSSv3.1 Base Score: 9.6 / Temporal Score: 8.3
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:X

CVE-2023-6955

There is a vulnerability in GitLab due to an improper access control. An attacker can bypass this and subsequently create a workspace in one group that is associated with an agent from another group.

CVSSv2 Base Score: 4.6 / Temporal Score: 3.4
AV:N/AC:H/AU:S/C:P/I:P/A:P/E:U/RL:OF/RC:ND
CVSSv3.1 Base Score: 6.6 / Temporal Score: 5.8
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N/E:U/RL:O/RC:X

CVE-2023-7028

There is a vulnerability in GitLab. In the password reset function, multiple email addresses can be passed via URL manipulation. As long as one of these addresses belongs to a valid user account, the password reset token is sent to all specified addresses. A remote, anonymous attacker can exploit this to take over arbitrary user accounts, when they are not secured by multi-factor authentication.

CVSSv2 Base Score: 7.5 / Temporal Score: 5.9
AV:N/AC:L/AU:N/C:P/I:P/A:P/E:POC/RL:OF/RC:ND
CVSSv3.1 Base Score: 10.0 / Temporal Score: 9.0
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:X

Various PoCs exist on the Internet for the vulnerability CVE-2023-7028, e.g. on Twitter / X.

Recommendation

The developers provide updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/

Information

GitLab Critical Security Release: 16.7.2, 16.6.4, 16.5.6 dated 2024-01-11
https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/

CVE-2023-7028 PoC
https://twitter.com/h4x0r_dz/status/1745722638809305440

References

CVE:CVE-2023-2030
CVE:CVE-2023-4812
CVE:CVE-2023-5356
CVE:CVE-2023-6955
CVE:CVE-2023-7028

Disclaimer

*The probability of an attack is determined by the attacker's motivation, the necessary expend and the possibilities for an attack. The damage probability is determined by the expend needed to resolute the attack and probable indirect consequences of an attack for business processes. Telekom Security assumes worst case scenarios.

Copyright © 1999-2026 Deutsche Telekom Security GmbH. All rights reserved. Reproduction and distribution of this publication in any form - even in parts - without prior written permission is forbidden.

The information contained herein has been obtained from sources believed to be reliable and trusted or have been verified. Telekom Security can take liability for completeness, accuracy and correctness only in so far, as gross negligence or intention create liability. Any liability beyond it, in particular possible damages resulting from using or non-usability of the information contained herein, is excluded.