About the Vulnerability
Introduction
GitLab is an open-source project for repository management systems and it uses Git as the code management tool, based on which it was built as a Web service.
Summary
On September 12, 2024, Sangfor FarSight Labs received notification that a GitLab component contains information of Authentication Bypass Vulnerability (CVE-2024-6678), classified as critical in threat level.
In GitLab CE/EE there exists an authentication bypass vulnerability, which allows attackers to trigger pipeline by impersonating other users, thereby bypassing authentication. This could lead to serious consequences such as repository leaks and server compromise.
Affected Versions
8.14 ≤ GitLab CE/EE < 17.1.7
17.2 ≤ GitLab CE/EE < 17.2.5
17.3 ≤ GitLab CE/EE < 17.3.2
Solutions
Remediation Solutions
Check the System Version
You can directly enter GitLab server address/help in browser
(eg. https://your.gitlab.com/help)
The version information of GitLab is presented on the user interface.
Official Solution
Affected users are strongly advised to update the version of GitLab to 17.3.2, 17.2.5, 17.1.7.
Download link: https://about.gitlab.com/update
Sangfor Solutions
Risky Assets Detection
Support is provided for proactive detection of GitLab; and it is capable of batch identifying the affected asset conditions of this event in business scenarios. Related products are as follows:
[Sangfor CWPP] has released an asset detection scheme, with Fingerprint ID: 0006687.
[Sangfor Host Security] has also released an asset detection scheme, with Fingerprint ID: 0006687.
Vulnerability Proactive Detection
Support is provided for proactive detection of GitLab Authentication Bypass Vulnerability (CVE-2024-6678); and it is capable of quickly batch identifying whether there are vulnerability risks in business scenarios. Related products are as follows:
[Sangfor Host Security] is expected to release a detection scheme on September 15, 2024 with Rule ID: SF-0005-21015.
[Sangfor Cyber Guardian MDR] is expected to release a detection scheme on September 19, 2024 with Rule ID: SF-0005-21015.
[Sangfor Omni-Command] is expected to release a detection scheme on September 15, 2024 (requiring Host Security component capabilities), with Rule ID: SF-0005-21015.
Timeline
On September 12, 2024, Sangfor FarSight Labs received notification of GitLab authentication Bypass vulnerability.
On September 12, 2024, Sangfor FarSight Labs released a vulnerability alert.
References
https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17- 3-2-released/#execute-environment-stop-actions-as-the-owner-of-the-stop-action-job
