GitLab has released security updates to address 14 security flaws, including one critical vulnerability that could be exploited to run continuous integration and continuous deployment (CI/CD) pipelines as any user.
The weaknesses, which affect GitLab Community Edition (CE) and Enterprise Edition (EE), have been addressed in versions 17.1.1, 17.0.3, and 16.11.5.
The most severe of the vulnerabilities is CVE-2024-5655 (CVSS score: 9.6), which could permit a malicious actor to trigger a pipeline as another user under certain circumstances.
It impacts the following versions of CE and EE –
- 17.1 prior to 17.1.1
- 17.0 prior to 17.0.3, and
- 15.8 prior to 16.11.5
GitLab said the fix introduces two breaking changes as a result of which GraphQL authentication using CI_JOB_TOKEN is disabled by default and pipelines will no longer run automatically when a merge request is re-targeted after its previous target branch is merged.
Some of the other important flaws fixed as part of the latest release are listed below –
- CVE-2024-4901 (CVSS score: 8.7) – A stored XSS vulnerability could be imported from a project with malicious commit notes
- CVE-2024-4994 (CVSS score: 8.1) – A CSRF attack on GitLab’s GraphQL API leading to the execution of arbitrary GraphQL mutations
- CVE-2024-6323 (CVSS score: 7.5) – An authorization flaw in the global search feature that allows for leakage of sensitive information from a private repository within a public project
- CVE-2024-2177 (CVSS score: 6.8) – A cross window forgery vulnerability that enables an attacker to abuse the OAuth authentication flow via a crafted payload
While there is no evidence of active exploitation of the flaws, users are recommended to apply the patches to mitigate against potential threats.