Multiple vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE)

1) Improper Certificate Validation

EUVDB-ID: #VU84412

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-6680

CWE-ID: CWE-295 - Improper Certificate Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper certificate validation issue in Smartcard authentication. A remote attacker can authenticate as another user given their public key if they use Smartcard authentication.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

GitLab Enterprise Edition: 11.6.0 - 16.6.1

External links

http://about.gitlab.com/releases/2023/12/13/security-release-gitlab-16-6-2-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper access control

EUVDB-ID: #VU84413

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-6564

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to in projects using subgroups to define who can push and/or merge to protected branches, there may have been instances in which subgroup members with the Developer role were able to push or merge to protected branches.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

GitLab Enterprise Edition: 16.4.3 - 16.6.1

External links

http://about.gitlab.com/releases/2023/12/13/security-release-gitlab-16-6-2-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper access control

EUVDB-ID: #VU84415

Risk: Medium

CVSSv3.1: 5 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-6051

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the GitLab web interface does not ensure the integrity of information when downloading the source code from installation packages or tags. A remote user can compromise file integrity of the target application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 0.1.5 - 16.6.1

GitLab Enterprise Edition: 6.2.0 - 16.6.1

External links

http://about.gitlab.com/releases/2023/12/13/security-release-gitlab-16-6-2-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU84416

Risk: Low

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-3907

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions. A remote administrator can use a Project Access Token to escalate their role to Owner.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

GitLab Enterprise Edition: 16.0.0 - 16.6.1

External links

http://about.gitlab.com/releases/2023/12/13/security-release-gitlab-16-6-2-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Security features bypass

EUVDB-ID: #VU84418

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-5512

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the omission of double encoding in file names which facilitates the creation of repositories with malicious content. A remote user can use specific HTML encoding for file names leading for incorrect representation in the UI.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 16.3.0 - 16.6.1

GitLab Enterprise Edition: 16.3.0 - 16.6.1

External links

http://about.gitlab.com/releases/2023/12/13/security-release-gitlab-16-6-2-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Input validation error

EUVDB-ID: #VU84419

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-3904

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the unvalidated timeSpent value leads to unable to load issues on Issue board. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

GitLab Enterprise Edition: 6.2.0 - 16.6.1

External links

http://about.gitlab.com/releases/2023/12/13/security-release-gitlab-16-6-2-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper access control

EUVDB-ID: #VU84420

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-5061

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can override predefined CI variables via the REST API.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 9.3 - 16.6.1

GitLab Enterprise Edition: 9.3.0 - 16.6.1

External links

http://about.gitlab.com/releases/2023/12/13/security-release-gitlab-16-6-2-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper access control

EUVDB-ID: #VU84421

Risk: Low

CVSSv3.1: 1.8 [CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-3511

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote administrator can fork and submit merge requests to private projects they are not a member of.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

GitLab Enterprise Edition: 8.17.0 - 16.6.1

External links

http://about.gitlab.com/releases/2023/12/13/security-release-gitlab-16-6-2-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.