Corrective updates for the collaborative development platform have been released — GitLab 16.7.2, 16.6.4, and 16.5.6, which address two critical vulnerabilities. The first vulnerability (CVE-2023-7028), rated as a maximum threat level (10 out of 10), allows an attacker to capture another user's account through manipulation of the forgotten password recovery form. This issue arises from the ability to send a password reset code to unverified email addresses. The problem has been present since GitLab version 16.1.0, which introduced the option to send a password recovery code to an unverified backup email address.
To check for possible system compromise, it is suggested to review the gitlab-rails/production_json.log for HTTP requests to the /users/password handler, with an array of multiple emails in the parameter "params.value.email". It is also recommended to check the gitlab-rails/audit_json.log for entries with the value PasswordsController#create in meta.caller.id, and indicating an array of multiple addresses in the target_details block. The attack cannot be executed if the user has two-factor authentication enabled.
The second vulnerability CVE-2023-5356 is present in the code for integration with Slack and Mattermost services, allowing the execution of commands as another user due to inadequate authorization checks. This issue has been assigned a threat level of 9.6 out of 10. In the new versions, a less critical vulnerability (7.6 out of 10) has also been fixed (CVE-2023-4812), which allowed bypassing CODEOWNERS confirmation by adding changes to a previously approved merge request.
Detailed information about the identified vulnerabilities is planned to be disclosed 30 days after the release of the fix. Information about the vulnerabilities has been communicated to GitLab as part of the ongoing HackerOne bug bounty program.
Source: opennet.ru
