CVE-2023-3914: GitLab EE Business Logic Error Allows Access to Internal Projects - Exploit Details, References, and Code Snippet

In today's highly interconnected world, security has become increasingly important as companies use multiple applications to manage their projects and collaborate effectively. GitLab, a web-based DevOps platform, has become a go-to choice for many organizations looking for an all-in-one tool to manage their code, collaborate on development tasks, and deploy to their users. However, as the popular adage goes, with great power comes great responsibility - ensuring the security of these systems is of paramount importance.

Recently, a critical vulnerability was discovered in the popular GitLab EE (Enterprise Edition), which is used by millions of developers worldwide. The vulnerability, dubbed as CVE-2023-3914 affects all versions of GitLab prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. This vulnerability allows unauthorized users to access internal projects due to a business logic error.

Exploit Details

The vulnerability in question is caused by a business logic error. When developers using GitLab EE create a new project, a unique namespace is created for that project. This namespace consists of a service account that manages access and permissions for the project. However, GitLab EE fails to delete the service account when the associated namespace is deleted.

This oversight allows malicious actors to take advantage of the orphaned service account to gain access to the internal projects. Since the orphaned service account is not tied to any namespace, it can be reused to access any internal projects that the service account originally had access to, bypassing proper authorization and compromising the security of the entire GitLab EE platform.

Here's a code snippet that demonstrates the problem

// Create a new project with namespace
Project project = new Project(namespace, name);
project.create();

// Delete the namespace associated with the project
namespace.delete();

// The service account is not deleted, leaving it vulnerable to unauthorized access
ServiceAccount serviceAccount = project.getServiceAccount();

// Access an internal project using the orphaned service account
InternalProject internalProject = InternalProject.get(serviceAccount);

In the code snippet above, an internal project is accessed using the orphaned service account, even after the associated namespace has been deleted.

References

The official GitLab advisory detailing the CVE-2023-3914 vulnerability can be found here: GitLab Security Release: 13.10.3, 13.9.6, and 13.8.9

Furthermore, the patch notes for the affected GitLab versions can be found in their respective links

- GitLab 16.2.8 patch notes
- GitLab 16.3.5 patch notes
- GitLab 16.4.1 patch notes

Mitigation

To mitigate the vulnerability, GitLab has released patches for affected versions. Users are strongly advised to upgrade their GitLab EE instances to one of the following versions: 16.2.8, 16.3.5, or 16.4.1, depending on their current version.

Additionally, it is essential to perform regular audits on your GitLab EE instance, continually monitor for any unauthorized access, and ensure that proper authorization and access controls are in place.

Conclusion

In summary, the CVE-2023-3914 vulnerability in the GitLab EE platform results from a business logic error that leaves orphaned service accounts active even after their associated namespace is deleted. This vulnerability allows unauthorized access to internal projects, compromising the security of users' code and data.

To maintain the security of your GitLab EE instance, it is crucial to update to the latest patched version and perform regular audits to ensure that proper authorization and access controls are in place.

Timeline

Published on: 09/29/2023 07:15:00 UTC
Last modified on: 10/03/2023 15:31:00 UTC