Federal frenzy to patch gaping Gitlab account takeover hole

{
  "by": "rntn",
  "descendants": 17,
  "id": 40237116,
  "kids": [
    40238299,
    40238566,
    40239017,
    40238825,
    40238003
  ],
  "score": 57,
  "time": 1714662155,
  "title": "Federal frenzy to patch gaping Gitlab account takeover hole",
  "type": "story",
  "url": "https://www.theregister.com/2024/05/02/critical_gitlab_vulnerability/"
}

{
  "author": "Connor Jones",
  "date": "2024-05-02T12:07:40.000Z",
  "description": "Warning comes exactly a year after the vulnerability was introduced",
  "image": "https://regmedia.co.uk/2019/10/17/shutterstock_gitlab_logo.jpg",
  "logo": "https://logo.clearbit.com/theregister.com",
  "publisher": "The Register",
  "title": "Federal frenzy to patch gaping security hole in GitLab",
  "url": "https://www.theregister.com/2024/05/02/critical_gitlab_vulnerability/"
}

{
  "url": "https://www.theregister.com/2024/05/02/critical_gitlab_vulnerability/",
  "title": "Federal frenzy to patch gaping security hole in GitLab",
  "description": "The US Cybersecurity and Infrastructure Security Agency (CISA) is forcing all federal agencies to patch a critical vulnerability in GitLab's Community and Enterprise editions, confirming it is very much under...",
  "links": [
    "https://www.theregister.com/2024/05/02/critical_gitlab_vulnerability/",
    "https://www.theregister.com/AMP/2024/05/02/critical_gitlab_vulnerability/"
  ],
  "image": "https://regmedia.co.uk/2019/10/17/shutterstock_gitlab_logo.jpg",
  "content": "<div>\n<p>The US Cybersecurity and Infrastructure Security Agency (CISA) is forcing all federal agencies to patch a critical vulnerability in GitLab's Community and Enterprise editions, confirming it is very much under \"active exploit.\"</p>\n<p>When CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) list, it means all federal civilian executive branch (FCEB) agencies usually have a maximum of 21 days to fix the issue to prevent harmful attacks on the government.</p>\n<p>The name is somewhat of a giveaway, but security flaws added to the KEV list also mean they're known to be under active exploitation, necessitating a quick fix.</p>\n<p>The vulnerability, tracked as CVE-2023-7028, was <a target=\"_blank\" href=\"https://www.theregister.com/2024/01/15/critical_gitlab_vulnerability/\">disclosed by GitLab in January</a> and was assigned a maximum 10 severity rating by the platform itself, which is a certified CVE Numbering Authority (CNA). The <a target=\"_blank\" href=\"https://www.theregister.com/2024/03/22/opinion_column_nist/\">National Vulnerability Database</a> (NVD) gave it a mere 7.5 score, however.</p>\n<p>At the time of disclosure, GitLab reported that the vulnerability had existed since May 2023, though there was no evidence of successful exploitation. The addition to CISA's KEV means this is now no longer the case, so get those patches installed pronto if they weren't sorted in January.</p>\n<p>The vulnerability is classed as an improper access control flaw, offering attackers a zero-click route to a full account takeover. </p>\n<p>Starting in version 16.1.0, released May 1, 2023, a change was introduced that allowed users to reset their GitLab account passwords using a different email address, and a bug in the verification process opened up the vulnerability.</p>\n<p>A specially crafted HTTP request sends a password reset link to an unverified, attacker-controlled email address, enabling unauthorized account takeovers.</p>\n<p>Given the nature of GitLab's business, the obvious danger here is the vulnerability being abused by attackers to carry out software supply chain attacks – surreptitiously modifying source code to breach countless organizations.</p>\n<p>Russia with <a target=\"_blank\" href=\"https://www.theregister.com/2023/10/31/sec_charges_solarwinds_sunburst_fraud/\">SolarWinds</a> and North Korea with <a target=\"_blank\" href=\"https://www.theregister.com/2023/04/24/in_brief_security/\">3CX</a> are two examples of adversarial nations with an appetite for supply chain attacks in recent years. Ransomware crews such as <a target=\"_blank\" href=\"https://www.theregister.com/2024/05/02/revil_ransomware_prison/\">REvil</a> with <a target=\"_blank\" href=\"https://www.theregister.com/2021/07/08/kaseya_dutch_vulnerability/\">Kaseya</a> and Cl0p with <a target=\"_blank\" href=\"https://www.theregister.com/2023/11/20/moveit_victim_77m_medical/\">MOVEit</a> are also no strangers to compromising software at the source, although CISA said it isn't aware of any ransomware-associated activity with the GitLab flaw yet.</p>\n<ul>\n<li><a target=\"_blank\" href=\"https://www.theregister.com/2024/05/01/r_programming_language_ace_vuln/\">Open source programming language R patches gnarly arbitrary code exec flaw</a></li>\n<li><a target=\"_blank\" href=\"https://www.theregister.com/2024/04/24/spies_cisco_firewall/\">Governments issue alerts after 'sophisticated' state-backed actor found exploiting flaws in Cisco security boxes</a></li>\n<li><a target=\"_blank\" href=\"https://www.theregister.com/2024/04/23/russia_fancy_bear_goose_egg/\">Old Windows print spooler bug is latest target of Russia's Fancy Bear gang</a></li>\n<li><a target=\"_blank\" href=\"https://www.theregister.com/2024/04/17/researchers_exploit_code_for/\">Exploit code for Palo Alto Networks zero-day now public</a></li>\n</ul>\n<p>The upshot of all this is that admins who enabled some form of two-factor authentication (2FA) in GitLab are safe and unaffected by the vulnerability. And of course you enabled <a target=\"_blank\" href=\"https://www.theregister.com/2024/01/11/mandiant_x_account_brute_forced/\">2FA</a>, didn't you?</p>\n<p>The following versions are vulnerable: </p>\n<ul>\n<li>\n<p>16.1 to 16.1.5</p>\n</li>\n<li>\n<p>16.2 to 16.2.8</p>\n</li>\n<li>\n<p>16.3 to 16.3.6</p>\n</li>\n<li>\n<p>16.4 to 16.4.4</p>\n</li>\n<li>\n<p>16.5 to 16.5.5</p>\n</li>\n<li>\n<p>16.6 to 16.6.3</p>\n</li>\n<li>\n<p>16.7 to 16.7.1</p>\n</li>\n</ul>\n<div><p><a href=\"https://regmedia.co.uk/2024/05/02/gitlab_vulnerable_instances.jpg\" target=\"_blank\"><img src=\"https://regmedia.co.uk/2024/05/02/gitlab_vulnerable_instances.jpg?x=648&amp;y=344&amp;infer_y=1\" alt=\"Shadowserver data showing number of vulnerable GitLab instances since the vulnerability's disclosure\" title=\"Shadowserver data showing number of vulnerable GitLab instances since the vulnerability's disclosure\" /></a></p><p>Shadowserver data showing number of vulnerable GitLab instances since the vulnerability's disclosure – click to enlarge</p>\n</div>\n<p>Shadowserver's <a target=\"_blank\" href=\"https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=180&amp;source=http_vulnerable&amp;source=http_vulnerable6&amp;tag=cve-2023-7028%2B&amp;dataset=unique_ips&amp;style=stacked\">data</a> shows that the number of publicly exposed GitLab instances has more than halved since the vulnerability's disclosure. There are currently 2,149 vulnerable GitLab environments, down from 4,652 in January, with the largest concentration in Europe and Asia.</p>\n<p>GitLab fixed the vulnerability in versions 16.5.6, 16.6.4, and 16.7.2, and also backported the patches for versions 16.1.6, 16.2.9, 16.3.7, and 16.4.5. ®</p>                                \n                    </div>",
  "author": "",
  "favicon": "https://www.theregister.com/design_picker/13249a2e80709c7ff2e57dd3d49801cd534f2094/graphics/favicons/favicon.svg",
  "source": "theregister.com",
  "published": "2024-05-02t14:15:14z",
  "ttr": 109,
  "type": "article"
}