Rewterz Threat Advisory – Multiple GitLab CE/EE Vulnerabilities

Severity

Medium

Analysis Summary

CVE-2022-2882 CVSS:5.5
GitLab EE could allow a remote authenticated attacker to bypass security restrictions. By modifying the integration URL, an attacker could exploit this vulnerability to exfiltrate a GitHub integration’s access token.

CVE-2022-2904 CVSS:7.3
GitLab CE/EE is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability using the external status checks feature to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.

CVE-2022-3018 CVSS:6.8
GitLab CE/EE could allow a remote authenticated attacker to obtain sensitive information. By sending a specially-crafted request, an attacker could exploit this vulnerability to access the DataDog integration API key from webhook logs.

CVE-2022-3060 CVSS:7.3
GitLab CE/EE could allow a remote authenticated attacker to bypass security restrictions, caused by improper control of a resource identifier in Error Tracking. By sending a specially-crafted request, an attacker could exploit this vulnerability to generate content which could cause a victim to make unintended arbitrary requests.

CVE-2022-3066 CVSS:7.3
GitLab CE/EE could allow a remote authenticated attacker to bypass security restrictions, caused by improper control of a resource identifier in Error Tracking. By sending a specially-crafted request, an attacker could exploit this vulnerability to generate content which could cause a victim to make unintended arbitrary requests.

CVE-2022-3067 CVSS:5.4
GitLab EE could allow a remote authenticated attacker to bypass security restrictions, caused by improper access control. By sending a specially-crafted request, an attacker could exploit this vulnerability to create issues in any project.

CVE-2022-3283 CVSS:7.5
GitLab CE/EE is vulnerable to a denial of service. By cloning an issue with special crafted content added to the description, a remote attacker could exploit this vulnerability to trigger high CPU usage..

CVE-2022-3285 CVSS:5.3
GitLab EE is vulnerable to a denial of service, caused by a flaw in the Healthcheck endpoint. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to prevent access to GitLab.

CVE-2022-3286 CVSS:5.3
GitLab EE could allow a remote attacker to bypass security restrictions, caused by lack of IP address checking. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass IP restrictions when using a deploy token.

CVE-2022-3288 CVSS:3.5
GitLab CE/EE could allow a remote authenticated attacker to bypass security restrictions, caused by branch/tag name confusion with the default branch name. By sending a specially-crafted request, an attacker could exploit this vulnerability to manipulate pages.

Impact

• Securiy Bypass
• Cross-Site Scripting
• Information Disclosure
• Denial of Service

Indicators Of Compromise

CVE

• CVE-2022-2882
• CVE-2022-2904
• CVE-2022-3018
• CVE-2022-3060
• CVE-2022-3066
• CVE-2022-3067
• CVE-2022-3283
• CVE-2022-3285
• CVE-2022-3286
• CVE-2022-3288

Affected Vendors

GitLab

Affected Products

• GitLab Enterprise Edition 15.2.4
• GitLab Enterprise Edition 15.3.3
• GitLab Enterprise Edition 15.4
• GitLab Community Edition 15.2.4
• GitLab Community Edition 15.3.3
• GitLab Community Edition 15.4

Remediation

Refer to GitLab Website for patch, upgrade or suggested workaround information.
GitLab Website