Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.2712
GitLab Critical Security Release: 15.0.1, 14.10.4, and 14.9.5
2 June 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: GitLab Community Edition
GitLab Enterprise Edition
Publisher: GitLab
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Resolution: Patch/Upgrade
CVE Names: CVE-2022-1948 CVE-2022-1944 CVE-2022-1940
CVE-2022-1936 CVE-2022-1935 CVE-2022-1821
CVE-2022-1783 CVE-2022-1680
Original Bulletin:
https://about.gitlab.com/releases/2022/06/01/critical-security-release-gitlab-15-0-1-released/
Comment: CVSS (Max): 9.9 CVE-2022-1680 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
CVSS Source: GitLab
Calculator: https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
GitLab Critical Security Release: 15.0.1, 14.10.4, and 14.9.5
Today we are releasing versions 15.0.1, 14.10.4, and 14.9.5 for GitLab
Community Edition (CE) and Enterprise Edition (EE). Please note, this critical
release will also serve as our monthly security release for May.
These versions contain important security fixes, and we strongly recommend that
all GitLab installations be upgraded to one of these versions immediately.
GitLab.com is already running the patched version.
GitLab releases patches for vulnerabilities in dedicated security releases.
There are two types of security releases: a monthly, scheduled security
release, released approximately one week after the feature release (which
deploys on the 22nd of each month), and ad-hoc security releases for critical
vulnerabilities. For more information, you can visit our security FAQ. You can
see all of our regular and security release blog posts here. In addition, the
issues detailing each vulnerability are made public on our issue tracker 30
days after the release in which they were patched.
We are dedicated to ensuring all aspects of GitLab that are exposed to
customers or that host customer data are held to the highest security
standards. As part of maintaining good security hygiene, it is highly
recommended that all customers upgrade to the latest security release for their
supported version. You can read more best practices in securing your GitLab
instance in our blog post.
Recommended Action
We strongly recommend that all installations running a version affected by the
issues described below are upgraded to the latest version as soon as possible.
When no specific deployment type (omnibus, source code, helm chart, etc.) of a
product is mentioned, this means all types are affected.
Table of Fixes
Title Severity
Account take over via SCIM email change critical
Stored XSS in Jira integration high
Quick action commands susceptible to XSS high
IP allowlist bypass when using Trigger tokens medium
IP allowlist bypass when using Project Deploy Tokens medium
Improper authorization in the Interactive Web Terminal medium
Subgroup member can list members of parent group medium
Group member lock bypass low
Account take over via SCIM email change
An account takeover issue has been discovered in GitLab EE affecting all
versions starting from 11.10 before 14.9.5, all versions starting from 14.10
before 14.10.4, all versions starting from 15.0 before 15.0.1. When group SAML
SSO is configured, the SCIM feature (available only on Premium+ subscriptions)
may allow any owner of a Premium group to invite arbitrary users through their
username and email, then change those users' email addresses via SCIM to an
attacker controlled email address and thus - in the absence of 2FA - take over
those accounts. It is also possible for the attacker to change the display name
and username of the targeted account. This is a critical severity issue
(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9). It is now mitigated in the
latest release and is assigned CVE-2022-1680.
This vulnerability was discovered internally by a member of the GitLab team.
Self-managed administrators can check whether group_saml is enabled by
reviewing "Configuring Group SAML on a self-managed GitLab instance".
Stored XSS in Jira integration
A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE
affecting all versions from 13.11 prior to 14.9.5, 14.10 prior to 14.10.4, and
15.0 prior to 15.0.1 allows an attacker to execute arbitrary JavaScript code in
GitLab on a victim's behalf via specially crafted Jira Issues. This is a high
severity issue (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N, 7.7). It is now
mitigated in the latest release and is assigned CVE-2022-1940.
Thanks joaxcar for reporting this vulnerability through our HackerOne bug
bounty program.
Quick action commands susceptible to XSS
An issue has been discovered in GitLab affecting all versions starting from
15.0 before 15.0.1. Missing validation of input used in quick actions allowed
an attacker to exploit XSS by injecting HTML in contact details. This is a high
severity issue (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7). It is now
mitigated in the latest release and is assigned CVE-2022-1948.
Thanks cryptopone for reporting this vulnerability through our HackerOne bug
bounty program.
IP allowlist bypass when using Trigger tokens
Incorrect authorization in GitLab EE affecting all versions from 12.0 before
14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting
from 15.0 before 15.0.1 allowed an attacker already in possession of a valid
Project Trigger Token to misuse it from any location even when IP address
restrictions were configured. This is a medium severity issue (CVSS:3.0/AV:N/
AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, 6.5). It is now mitigated in the latest release
and is assigned CVE-2022-1935.
This vulnerability has been discovered internally by the GitLab team.
IP allowlist bypass when using Project Deploy Tokens
Incorrect authorization in GitLab EE affecting all versions from 12.0 before
14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting
from 15.0 before 15.0.1 allowed an attacker already in possession of a valid
Project Deploy Token to misuse it from any location even when IP address
restrictions were configured. This is a medium severity issue (CVSS:3.0/AV:N/
AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, 6.5). It is now mitigated in the latest release
and is assigned CVE-2022-1936.
This was reported by a customer through our Responsible Vulnerability
Disclosure process.
Improper authorization in the Interactive Web Terminal
When the feature is configured, improper authorization in the Interactive Web
Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5,
14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows users with the
Developer role to open terminals on other Developers' running jobs. This is a
medium severity issue (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N, 5.4). It
is now mitigated in the latest release and is assigned CVE-2022-1944.
This vulnerability has been discovered internally by the GitLab team.
Subgroup member can list members of parent group
An issue has been discovered in GitLab CE/EE affecting all versions starting
from 10.8 before 14.9.5, all versions starting from 14.10 before 14.10.4, all
versions starting from 15.0 before 15.0.1. It may be possible for a subgroup
member to access the members list of their parent group. This is a medium
severity issue (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3). It is now
mitigated in the latest release and is assigned CVE-2022-1821.
This vulnerability was discovered internally by a member of the GitLab team.
Group member lock bypass
An issue has been discovered in GitLab CE/EE affecting all versions starting
from 14.3 before 14.9.5, all versions starting from 14.10 before 14.10.4, all
versions starting from 15.0 before 15.0.1. It may be possible for malicious
group maintainers to add new members to a project within their group, through
the REST API, even after their group owner enabled a setting to prevent members
from being added to projects within that group. This is a low severity issue
(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N, 2.7). It is now mitigated in the
latest release and is assigned CVE-2022-1783.
Thanks salh4ckr for reporting this vulnerability through our HackerOne bug
bounty program.
Update Mattermost
The version of Mattermost has been updated to 6.6.1 in order to mitigate
security concerns.
Versions affected
Affects GitLab Omnibus prior to 15.0.
Updating
To update GitLab, see the Update page. To update Gitlab Runner, see the
Updating the Runner page.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBYpf548kNZI30y1K9AQgZuw/9FtKmUGWO/q96IKGAsFpkYwaiEDP+Mt42
oS6OPsIbQ+fqmKXFwqZRU5ugR18Nfnzc/YpGYW6Og8tWqLDzLMCAzIqTHvvMeKJg
0dxDrkNUgQjGYNeuIcp9QsbOFG+4pzp1GezwoS+Y/XkUGMdb/NRC2pqFgTjZML1Y
vSMlvXaNz2ae589Y8ygTrz+C6kE+QvipjksbNuaZJYWmVrWmrt0Pw7W1CaVaWoRE
2g0H+fttc2NBFUNfBCVFnWjToBXNm3L2voasgsKbWaziBeB7pIc+xRYQ25xca5Ol
7vOZE5oecvUIwONDzPX/m53DW3T/q8QZnMgfu0RvXTrHO0j0O9x5FfX6UwT0d8D1
VbyZPgi4EhfqFCa1Nenv8cCw3USMzI2LzvPWGrC2ZaudJs18l0Gb22PphdLnfMQk
2y3uR07cKh+sHecFEFBUV2mbu8Gj+aJwg5Gw0VPGgJqPDLofhwSYuCtMrLIlXlej
htXoYv9kwhDs9CtPiXWUpwjmFvaPlYvJLWuiaj+GVHGCJdnlfQ6oZsfzytKCuJmn
816XRQLaTOVFpTk9uKyHzPVQ5RhS8/qV0x9PpYSgxsoi++vYtcMhyQj8LhNEAPzN
UfSQOEXux0DwT/k9S8CBrn2dmxcdYGu/MW/2PNseROArYak9Op88U55+HD/uaXfE
uGZlHhVEY3M=
=lYVC
-----END PGP SIGNATURE-----