A vulnerability affecting GitLab Community and Enterprise Editions, has been assigned the highest possible CVSS score of 10.0. GitLab is a web-based Git repository used for remote code management by developers and their teams, with approximately 30 million registered users. GitLab have released an emergency security update to address this critical flaw which they advise customers to upgrade to as soon as possible. This vulnerability was first identified by a user through GitLab’s HackerOne bug bounty program, a cyber security platform for ethical hackers used to uncover critical vulnerabilities.
Tracked as CVE-2023-2825 this is a path traversal vulnerability, which generally occurs when an external input is used to construct a pathname that is supposed to be within a restricted directory, however a flaw with improper neutralisation of sequences results in the system resolving to a location outside the directory. In this case, an attacker can exploit this path traversal vulnerability to read arbitrary files on the vulnerable server. In order for this attack to take place some conditions must be met. An attachment must exist in a public project, and be nested within at least five groups. If the attack is successful this could cause sensitive data to be exposed, including software code, user credentials, and other files.
This maximum severity flaw has only been found to affect version 16.0.0 of GitLab Community Edition, and Enterprise Edition. The latest security release containing a patch for this vulnerability is version 16.0.1. GitLab have stated that GitLab.com is already running the patched version, and “strongly recommend that GitLab installations running 16.0.0 be upgraded immediately”. Keeping all systems up to date throughout the software development life cycle ensures that your sensitive data and essential code is best protected from malicious attacks such as theft or compromise. Updates can be applied by visiting GitLab’s update page on their website, and following the instructions for your specific installation.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)