GitLab customers must replace their servers urgently to guard towards a brand new vital flaw that might permit menace actors to run pipelines as different customers and compromise personal repositories.
The flaw, CVE-2023-5009, is within the scheduled safety scan insurance policies, according to GitLaband is a bypass of one other bug from July, tracked underneath CVE-2023-3932.
“We strongly recommend that all installations running a version affected by the issues … are upgraded to the latest version as soon as possible,” GitLab stated.
Any person may probably exploit the vital flaw by altering the coverage file creator with the “got config” command, based on Alex Ilgayev, head of safety analysis at Cycode.
“The vulnerability is a bypass to another vulnerability reported and fixed one month ago, which allowed forging the identity of the policy file committer, hijacking the pipeline permissions, and gaining access to any users’ private repositories,” Ilgayev stated. “While GitLab didn’t release official information regarding the bypass, by inspecting the GitLab source code, the bypass seems to involve removing the bot user from the group and allowing the execution of the previous vulnerability flow again.”
Creator: Becky Bracken, Editor, Darkish Studying
Date: 2023-09-21 00:20:00
