A important vulnerability is affecting sure variations of GitLab Neighborhood and Enterprise Version merchandise, which might be exploited to run pipelines as any consumer.
GitLab is a well-liked web-based open-source software program mission administration and work monitoring platform. It has an estimated a million energetic license customers.
The safety problem addressed within the lasted replace is tracked as CVE-2024-5655 and has a severity rating of 9.6 out of 10. Underneath sure circumstances, which the seller didn’t outline, an attacker might leverage it to set off a pipeline as one other consumer.
GitLab pipelines are a characteristic of the Steady Integration/Steady Deployment (CI/CD) system that permits customers to robotically run processes and duties, both in parallel or in sequence, to construct, take a look at, or deploy code adjustments.
The vulnerability impacts all GitLab CE/EE variations from 15.8 via 16.11.4, 17.0.0 to 17.0.2, and 17.1.0 to 17.1.0.
GitLab has addressed the vulnerability by releasing variations 17.1.1, 17.0.3, and 16.11.5, and recommends customers to use the updates as quickly as potential.
The seller additionally informs that upgrading to the newest variations comes with two breaking adjustments that customers ought to concentrate on:
- Pipelines will not run robotically when a merge request is re-targeted after its earlier goal department is merged. Customers should manually begin the pipeline to execute CI for his or her adjustments.
- CI_JOB_TOKEN is now disabled by default for GraphQL authentication ranging from model 17.0.0, with this alteration backported to variations 17.0.3 and 16.11.5. To entry the GraphQL API, customers must configure one of many supported token sorts for authentication.
The newest GitLab replace additionally introduces safety fixes for 13 different points, the severity of three of them being rated as “excessive” (CVSS v3.1 rating: 7.5 – 8.7). These three are summarized as follows:
- CVE-2024-4901: Saved XSS vulnerability permitting malicious commit notes from imported tasks to inject scripts, probably resulting in unauthorized actions and information publicity.
- CVE-2024-4994: A CSRF vulnerability within the GraphQL API permitting attackers to execute arbitrary GraphQL mutations by tricking authenticated customers into making undesirable requests, probably resulting in information manipulation and unauthorized operations.
- CVE-2024-6323: Authorization flaw in GitLab’s world search characteristic permitting attackers to view search outcomes from personal repositories inside public tasks, probably resulting in info leaks and unauthorized entry to delicate information.
Sources for GitLab updates can be found right here, whereas GitLab Runner pointers may be discovered on this web page.
