ASB-2018.0034 - [Win][Linux][Virtual] GitLab Community Edition and Enterprise Edition: Multiple vulnerabilities 2018-01-18

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2018.0034
          Multiple vulnerabilities have been identified in GitLab
            Community Edition (CE) and Enterprise Edition (EE)
                              18 January 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              GitLab Community Edition and Enterprise Edition
Operating System:     Linux variants
                      Virtualisation
                      Windows
Impact/Access:        Execute Arbitrary Code/Commands -- Remote/Unauthenticated      
                      Modify Arbitrary Files          -- Existing Account            
                      Cross-site Scripting            -- Remote with User Interaction
                      Reduced Security                -- Remote/Unauthenticated      
                      Access Confidential Data        -- Existing Account            
                      Unauthorised Access             -- Existing Account            
Resolution:           Patch/Upgrade
CVE Names:            CVE-2018-3710 CVE-2017-0927 CVE-2017-0926
                      CVE-2017-0925 CVE-2017-0924 CVE-2017-0923
                      CVE-2017-0922 CVE-2017-0918 CVE-2017-0917
                      CVE-2017-0916 CVE-2017-0915 CVE-2017-0914
Member content until: Saturday, February 17 2018

OVERVIEW

        Multiple vulnerabilities have been identified in GitLab Community 
        Edition (CE) and Enterprise Edition (EE) prior to versions 10.3.4, 
        10.2.6, and 10.1.6. [1]


IMPACT

        The vendor has provided the following details regarding the 
        vulnerabilities:
        
        "Remote Code Execution Vulnerability in GitLab Projects Import The 
        GitLab projects import component contained a vulnerability which 
        allowed an attacker to write files to arbitrary directories on the 
        server and that could result in remote code execution. The 
        vulnerability has now been mitigated and is assigned to 
        CVE-2017-0915 and CVE-2018-3710." [1]
        
        "GitLab CI Runner Can Read and Poison Cache of All Other Projects A
        path traversal vulnerability was found in the CI runner, which 
        allowed a malicious user to read and poison other project caches. 
        The issue is now remediated and has been assigned to CVE-2017-0918."
        [1]
        
        "Jupyter Notebook XSS Projects that have Jupyter Notebooks could 
        execute external JavaScript. This XSS vulnerability was caused by 
        unsanitized output in Jupyter Notebooks. The output is now correctly
        sanitized before being rendered. This issue has been assigned to 
        CVE-2017-0923." [1]
        
        "Login with Disabled OAuth Provider via POST OAauth providers are 
        configured per instance and can be disabled from the Admin settings
        page under "Sign-in Restrictions".
        
        It was possible to login with a disabled OAuth provider when 
        bypassing the form with a malicious request. A check has been added
        to prevent this. This issue has been assigned to CVE-2017-0926." [1]
        "Sensitive Fields Exposed to Admins / Masters in the Services API 
        The Services API responses were exposing sensitive fields to the 
        Admins and Masters of the service's project. We now filter out those
        sensitive fields from the Services API responses. This issue has 
        been assigned to CVE-2017-0925." [1]
        
        "XSS in Label Dropdown A persistent XSS vulnerability was discovered
        in the issue/merge request sidebar label dropdown. Label names 
        inside the sidebar label dropdown are now escaped. This issue has 
        been assigned to CVE-2017-0924." [1]
        
        "Critical SQL Injection in MilestoneFinder A SQL injection 
        vulnerability was discovered in the MilestoneFinder component. The 
        affected SQL query has now been mitigated. This issue has been 
        assigned to CVE-2017-0914." [1]
        
        "Critical Vulnerability with Command Injection via Webhooks A new 
        line injection vulnerability was discovered in the Webhook component
        that allowed an attacker to inject non-HTTP commands in a TCP 
        stream. The issue has now been mitigated and assigned to 
        CVE-2017-0916." [1]
        
        "Cross-site scripting (XSS) vulnerability in CI job output A 
        persistent XSS vulnerability was discovered in the CI job component,
        and the issue has now been resolved by performing stricter input 
        validation. This issue has been assigned to CVE-2017-0917." [1]
        
        "Guest Users Can Give Deploy Keys in Other Projects Write Access An
        improper authorization vulnerability was discovered in the 
        deployment keys component which resulted in unauthorized use of 
        deployment keys by guest users. The issue has now been resolved and
        is assigned to CVE-2017-0927. This change altered the /deploy_keys 
        API endpoint, which no longer returns can_push attribute. See our 
        updated documentation." [1]
        
        "Milestone Authorization Issue on Boards An authorization bypass 
        vulnerability was discovered in the Boards component which resulted
        in an information disclosure. The issue has now been resolved and is
        assigned to CVE-2017-0922." [1]


MITIGATION

        The vendor strongly recommends users upgrade to the latest versions
        to fix these issues. [1]


REFERENCES

        [1] GitLab Security Release: 10.3.4, 10.2.6, and 10.1.6
            https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWmAqrox+lLeg9Ub1AQhRBw//Qja8TuxUaxRQv0WkXP/+8fiysHLU+krJ
A9Nzla9H9W/goQ92f+fmc9y4+WLCibfZR1wouaB6J72MVCEkVrDpENyLDo6i+Eyw
uRO2oOX7ApW/dosbh+h1oFfN7DYZgTdu4WL6JZhktWo20X7dhnG2NtHmTsAtnMWe
xGI8/uIwU3xZxNCbjAhB05hsS/kK4IbY9wNYzhZR/igbVWHZYhcIxyurfZZ4YBrR
H8BFr9J+w4j0pC+U/qsuZ46EjQU1QoB0lOnaTxdRS2Oh/yQqRR+V4c56Ww444849
DNvoHwoY8O9LOroDwwW0/C5RPPfvrDUMubKPyifwvP/TZpEi+h/UBnfloeVp1g21
wBOLgNQFATT5QAQCzp31N9TSj++3supMAQlBY1/7czt40nksddX5pooRH0XoVDXr
g+TPordHSqDLJOHpup0+QGPbtU2BDMqA2E9F5WfVqkpmq13oKK0B3Vp9f3SaoUot
O/SX5rm0ZFqpCh+XoeT7Wcl+FAaNAq4On0t2mjrH2273i4m72DDD9irvnpiEsyfo
QtoKIh9HoOxGhZiRhh/1SNVc1snUk2Z6l20DqNg+BcEYgbpgH+CoynCMv/LTAaq5
Hl66vqX7ehygchIMW/sIdwzTxXhMG6t1oQ1GKYeL/fGzLb3L96T7gpac+T67aCGZ
6ComjiHfxfY=
=CjgM
-----END PGP SIGNATURE-----

« Back to bulletins