PT-2023-2917 · Gitlab · Gitlab Ce/Ee+1

Yvvdwfon · CVE-2023-2478 · Published 2023-05-06 · Updated 2024-03-06

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 15.4 through 15.9.6 GitLab CE/EE versions 15.10 through 15.10.5 GitLab CE/EE versions 15.11 through 15.11.1

Description An issue has been discovered in GitLab CE/EE, where under certain conditions, a malicious unauthorized GitLab user may use a GraphQL endpoint to attach a malicious runner to any project. The vulnerability is related to incorrect permission assignment for a critical resource when handling the GraphQL endpoint. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information.

Recommendations For GitLab CE/EE versions 15.4 through 15.9.6, update to version 15.9.7 to resolve the issue. For GitLab CE/EE versions 15.10 through 15.10.5, update to version 15.10.6 to resolve the issue. For GitLab CE/EE versions 15.11 through 15.11.1, update to version 15.11.2 to resolve the issue. As a temporary workaround, consider restricting access to the GraphQL endpoint to minimize the risk of exploitation.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2023-02886

BIT-GITLAB-2023-2478

CVE-2023-2478

Affected Products

Gitlab

Gitlab Ce/Ee

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2478.json · Exploit
• 🔥 https://gitlab.com/gitlab-org/gitlab/-/issues/409470 · Exploit
• https://safe-surf.ru/specialists/bulletins-nkcki/692462 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-2478 · Security Note
• https://ubuntu.com/security/CVE-2023-2478 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2478 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-2478 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02886 · Security Note
• https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2478.json · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2023-2478 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-2478 · Vendor Advisory
• https://hackerone.com/reports/1969599 · Note
• https://t.me/cibsecurity/63474 · Telegram Post
• https://t.me/pentestingnews/35726 · Telegram Post
• https://t.me/opennews/11422 · Telegram Post