{"id":103442,"date":"2022-02-27T09:36:43","date_gmt":"2022-02-27T07:36:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-gitlab-pozvolyayushhaya-poluchit-dostup-k-tokenam-runner"},"modified":"2022-02-27T09:36:43","modified_gmt":"2022-02-27T07:36:43","slug":"uyazvimost-v-gitlab-pozvolyayushhaya-poluchit-dostup-k-tokenam-runner","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-gitlab-pozvolyayushhaya-poluchit-dostup-k-tokenam-runner","title":{"rendered":"Luka w GitLab umo\u017cliwiaj\u0105ca uzyskanie dost\u0119pu do token\u00f3w Runner","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

W aktualizacjach krytycznych platformy do organizacji wsp\u00f3lnej pracy GitLab 14.8.2, 14.7.4 i 14.6.5 naprawiono krytyczn\u0105 luk\u0119 (CVE-2022-0735), umo\u017cliwiaj\u0105c\u0105 nieautoryzowanym u\u017cytkownikom uzyskanie token\u00f3w rejestracyjnych w GitLab Runner, u\u017cywanym do wywo\u0142ywania handler\u00f3w przy budowie kodu projektu w systemie ci\u0105g\u0142ej integracji. Szczeg\u00f3\u0142y nie s\u0105 na razie podawane, wspomniano jedynie, \u017ce problem wynika z wycieku informacji podczas korzystania z polece\u0144 Quick Actions. <\/p>\n

Problem zosta\u0142 zidentyfikowany przez pracownik\u00f3w GitLab i dotyczy wersji od 12.10 do 14.6.5, od 14.7 do 14.7.4 oraz od 14.8 do 14.8.2. U\u017cytkownikom, kt\u00f3rzy obs\u0142uguj\u0105 w\u0142asne instalacje GitLab, zaleca si\u0119 jak najszybsze zainstalowanie aktualizacji lub zastosowanie \u0142atki. Problem zosta\u0142 rozwi\u0105zany poprzez ograniczenie dost\u0119pu do komend Quick Actions tylko dla u\u017cytkownik\u00f3w posiadaj\u0105cych uprawnienia do zapisu. Po zainstalowaniu aktualizacji lub poszczeg\u00f3lnych \u0142atek \u201etoken-prefix\u201d, wcze\u015bniej utworzone tokeny rejestracji w Runner dla grup i projekt\u00f3w zostan\u0105 zresetowane i wygenerowane na nowo. <\/p>\n

Opr\u00f3cz krytycznej luki, w nowych wersjach naprawiono r\u00f3wnie\u017c 6 mniej powa\u017cnych luk, kt\u00f3re mog\u0105 prowadzi\u0107 do dodawania nieuprzywilejowanych u\u017cytkownik\u00f3w do grup, dezinformacji u\u017cytkownik\u00f3w poprzez manipulacj\u0119 tre\u015bci\u0105 Snippet-\u00f3w, wycieku zmiennych \u015brodowiskowych poprzez metod\u0119 dostarczania sendmail, sprawdzania obecno\u015bci u\u017cytkownik\u00f3w przez API GraphQL, wycieku hase\u0142 podczas lustracji repozytori\u00f3w przez SSH w trybie pull, a tak\u017ce DoS-atak\u00f3w przez system komentarzy.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 GitLab 14.8.2, 14.7.4 \u0438 14.6.5 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-0735), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u0442\u043e\u043a\u0435\u043d\u044b \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0432 GitLab Runner, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u0437\u043e\u0432\u0430 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438. \u0414\u0435\u0442\u0430\u043b\u0438 \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442\u0441\u044f, \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u043b\u0438\u0448\u044c \u0442\u043e, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0443\u0442\u0435\u0447\u043a\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043a\u043e\u043c\u0430\u043d\u0434 Quick […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103442","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Luka w GitLab, umo\u017cliwiaj\u0105ca dost\u0119p do token\u00f3w Runner | ProHoster","description":"W aktualizacjach krytycznych platformy do organizacji wsp\u00f3lnej pracy GitLab 14.8.2, 14.7.4 i 14.6.5 naprawiono krytyczn\u0105 luk\u0119 (CVE-2022-0735), umo\u017cliwiaj\u0105c\u0105 nieautoryzowanym u\u017cytkownikom uzyskanie.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-gitlab-pozvolyayushhaya-poluchit-dostup-k-tokenam-runner","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 GitLab, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0442\u043e\u043a\u0435\u043d\u0430\u043c Runner | ProHoster","og:description":"\u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 GitLab 14.8.2, 14.7.4 \u0438 14.6.5 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-0735), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0438\u0437\u0432\u043b\u0435\u0447\u044c.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-gitlab-pozvolyayushhaya-poluchit-dostup-k-tokenam-runner","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-02-27T07:36:43+00:00","article:modified_time":"2022-02-27T07:36:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103442","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-02-27 07:37:38","updated":"2022-09-28 16:29:13","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/103442","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=103442"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/103442\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=103442"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=103442"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=103442"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}