A critical GitLab vulnerability has been identified, tracked as CVE-2024-5655, affecting certain versions of GitLab Community and Enterprise Editions. This severe issue, with a CVSS score of 9.6 out of 10, enables attackers to run pipelines as any user, posing a significant security risk. It impacts all GitLab CE/EE versions from 15.8 through 16.11.4, 17.0.0 to 17.0.2, and 17.1.0. GitLab has released updates 17.1.1, 17.0.3, and 16.11.5 to address this vulnerability and strongly recommends immediate upgrades.
The CI/CD feature, crucial for Continuous Integration/Continuous Deployment processes, is at risk due to this pipeline exploitation. The latest updates also come with breaking changes.
- Pipelines will no longer run automatically when a merge request is re-targeted after merging
- CI_JOB_TOKEN is now disabled by default for GraphQL authentication from version 17.0.0 onwards.
In addition to CVE-2024-5655, the updates address 13 other security issues, including three high-severity vulnerabilities. CVE-2024-4901, a stored XSS vulnerability, allows malicious commit notes to inject scripts, potentially leading to unauthorized actions and data exposure. CVE-2024-4994, a CSRF vulnerability in the GraphQL API, permits attackers to execute arbitrary GraphQL mutations, leading to data manipulation and unauthorized operations. CVE-2024-6323, an authorization flaw, enables attackers to view search results from private repositories within public projects, potentially causing information leaks.
It is imperative for IT professionals, especially system administrators and DevOps engineers managing GitLab installations, to upgrade to the latest versions promptly. Security experts need to stay informed about these vulnerabilities and apply the necessary patches. Developers using GitLab for project management and CI/CD pipelines should also be aware of these updates to maintain security and functionality.
By following these updates, business stakeholders in tech companies can ensure that their operations remain secure and that sensitive data is protected from unauthorized access. For detailed upgrade instructions and more information on the breaking changes, visit the GitLab resources page and the GitLab Runner guidelines.
Maintaining an updated and secure GitLab environment is crucial in mitigating the risks associated with these vulnerabilities and ensuring the integrity of your development and deployment processes.