Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code
GitLab just patched two serious flaws that let attackers read private files, steal passwords, and even run commands on your servers. One flaw lets anyone see files they shouldn't, while another lets logged-in users steal credentials and run code if they trick you into clicking a link.
- Report priority
- High
- Targets
- GitLab
How it works
- Attackers send a specially crafted link to a GitLab user.
- If you click it, the first flaw lets them read any file on your server, like private project files or passwords.
- The second flaw lets them steal your login credentials and run commands on your server if you're logged in.
What to do
Check your installed GitLab version. If you're using GitLab Community Edition or Enterprise Edition before 16.7.4, you're affected. Cloud users who don't manage their own servers are not affected unless they self-hosted their instance.
Update GitLab to 16.7.4 or later immediately. If you're using the GitLab package manager, run the appropriate update command for your OS. For example, on Debian/Ubuntu, use sudo apt-get update && sudo apt-get upgrade gitlab-ce or sudo apt-get upgrade gitlab-ee. Verify the update by checking the version screen.
Technical details
GitLab has issued an emergency security update to address two critical vulnerabilities that could lead to unauthenticated file disclosure and authenticated credential theft, as well as a high-severity flaw that may enable remote code execution.