SECURITYWEEK NETWORK:

ICS:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

GitLab Patches Critical Pipeline Execution Vulnerability

GitLab has released security updates to address a critical-severity vulnerability allowing an attacker to run pipelines as another user.

DevOps platform GitLab this week announced the release of security updates that address a critical-severity vulnerability allowing an attacker to run pipelines as another user.

Tracked as CVE-2023-5009 (CVSS score of 9.6) and affecting all GitLab Enterprise Edition (EE) versions before 16.2.7 and GitLab Community Edition (CE) versions before 16.3.4, the bug is a bypass of another flaw, CVE-2023-3932, which was addressed in August 2023.

According to GitLab’s advisory, the issue allows “an attacker to run pipelines as an arbitrary user via scheduled security scan policies”.

The original vulnerability, CVE-2023-3932, was reported via GitLab’s HackerOne bug bounty program by a researcher who explained that the attacker could trigger the issue via the scan execution policy.

The bug could be triggered without any user interaction, but the attacker needed to know the victim’s GitLab username and the name of a victim’s internal or members-only project.

By exploiting the flaw, the attacker could gain access to projects containing private code, the researcher explained.

CVE-2023-5009 too was reported through the HackerOne platform, and GitLab encourages users to update to GitLab CE and EE versions 16.3.4 and 16.2.7, which resolve the flaw.

However, the code hosting platform also notes that for GitLab versions prior to 16.2 the vulnerability only exists if the ‘Direct transfers’ and ‘Security policies’ features are enabled at the same time.

Advertisement. Scroll to continue reading.

To mitigate the flaw, users that cannot upgrade to a patched version of GitLab can disable one or both these features.

“We strongly recommend that all installations running a version affected by the issues are upgraded to the latest version as soon as possible,” GitLab notes.

The code hosting platform makes no mention of this vulnerability being exploited in malicious attacks.

Related: GitLab Security Update Patches Critical Vulnerability

Related: GitLab Patches Critical Remote Code Execution Vulnerability

Related: Critical Account Takeover Vulnerability Patched in GitLab Enterprise Edition

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

More from

Latest News

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

CIEM Chat: How to Reduce Cloud Identity Risk
March 26, 2024

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

Virtual Event: Ransomware Resilience & Recovery Summit
April 17, 2024

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

People on the Move

Passwordless authentication firm Hawcx has appointed Lakshmi Sharma as Chief Product Officer.

Matt Hartley has been named Chief Revenue Officer at autonomous security solutions provider Horizon3.ai.

Trustwave has announced the appointment of Keith Ibarguen as Senior Vice President of Engineering.

More People On The Move

Expert Insights

Related Content

Full Disclosure List Gets a Fresh Start – Reborn Under New Operator

Vulnerabilities

Full Disclosure List Gets a Fresh Start – Reborn Under New Operator

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

March 26, 2014
ChatGPT attack ChatGPT attack

Data Breaches

ChatGPT Data Breach Confirmed as Security Firm Warns of Vulnerable Component Exploitation

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

March 28, 2023
16 Car Makers and Their Vehicles Hacked via Telematics, APIs, Infrastructure

IoT Security

16 Car Makers and Their Vehicles Hacked via Telematics, APIs, Infrastructure

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

January 5, 2023
Burglars Can Easily Disable SimpliSafe Alarms: Researcher

Vulnerabilities

Burglars Can Easily Disable SimpliSafe Alarms: Researcher

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

February 18, 2016
vector embeddings vector embeddings

Risk Management

Cyber Insights 2023 | Supply Chain Security

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

February 2, 2023
Russia hackers hit Microsoft Russia hackers hit Microsoft

Cybercrime

Microsoft Warns of Office Zero-Day Attacks, No Patch Available

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

July 11, 2023
Microsoft AI Microsoft AI

Vulnerabilities

Microsoft Warns of Outlook Zero-Day Exploitation, Patches 80 Security Vulns

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

March 14, 2023
Vulnerability Allows Hackers to Remotely Tamper With Dahua Security Cameras

IoT Security

Vulnerability Allows Hackers to Remotely Tamper With Dahua Security Cameras

A vulnerability affecting Dahua cameras and video recorders can be exploited by threat actors to modify a device’s system time.

February 9, 2023