Analysis
A vulnerability researcher in the HackerOne platform identified and reported the critical vulnerability in Gitlab (GitLab is a DevOps software package that combines the ability to develop, secure, and operate software in a single application) through HackerOne bug bounty program.
This vulnerability could allow an authenticated user to achieve remote code execution via the ‘Import from GitHub API’ endpoint, this vulnerability was classified as CVE-2022-2884 in Common Vulnerability and exposures vulnerability database, which has a severity of “Critical” and has a vulnerability score of 9.9 as per CVSS (Common vulnerability scoring system).
This vulnerability was identified in the GitLab Community edition/Enterprise edition affecting versions 11.3.4 to 15.1.5 then versions starting from 15.2 to 15.2.3, and versions starting from 15.3 to 15.3.1.
Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High
CVSS: 9.9
Prevention
GitLab has released a patch for this vulnerability and recommended its users to update to its latest version of Gitlab, which is currently using the vulnerable versions of applications to versions 15.3.1, 15.2.3, and 15.1.5.
References
GitLab
