{"id":112853,"date":"2024-01-12T15:10:23","date_gmt":"2024-01-12T13:10:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-gitlab-pozvolyayushhie-zahvatit-uchyotnuyu-zapis-i-vypolnit-komandy-pod-drugim-polzovatelem"},"modified":"2024-01-12T15:10:23","modified_gmt":"2024-01-12T13:10:23","slug":"uyazvimosti-v-gitlab-pozvolyayushhie-zahvatit-uchyotnuyu-zapis-i-vypolnit-komandy-pod-drugim-polzovatelem","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-gitlab-pozvolyayushhie-zahvatit-uchyotnuyu-zapis-i-vypolnit-komandy-pod-drugim-polzovatelem","title":{"rendered":"Vulnerabilities in GitLab that allow account takeover and executing commands under another user","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Corrective updates for collaborative development platform GitLab 16.7.2, 16.6.4, and 16.5.6 have been released, addressing two critical vulnerabilities. The first vulnerability (CVE-2023-7028), rated at the maximum severity level (10 out of 10), allows unauthorized account takeover through manipulation of the password reset form. This vulnerability arises from the ability to send a reset password code to unverified email addresses. The issue has existed since the release of GitLab 16.1.0, which introduced the capability to send the recovery code to an unverified backup email address. <\/p>\n
To verify potential system compromises, it is recommended to check the gitlab-rails\/production_json.log for HTTP requests to the handler \/users\/password, with an array of multiple emails provided in the parameter 'params.value.email'. It is also advised to inspect the gitlab-rails\/audit_json.log for entries with the value PasswordsController#create in meta.caller.id, indicating an array of multiple addresses in the target_details block. The attack cannot be fully executed if the user has two-factor authentication enabled. <\/p>\n
The second vulnerability CVE-2023-5356 is present in the code for integration with Slack and Mattermost services, allowing the execution of commands as another user due to inadequate authorization checks. This issue has been assigned a threat level of 9.6 out of 10. In the new versions, a less critical vulnerability (7.6 out of 10) has also been fixed (CVE-2023-4812), which allowed bypassing CODEOWNERS confirmation by adding changes to a previously approved merge request. <\/p>\n