GitLab, a popular platform known to host various types of sensitive data, has recently patched a high-severity vulnerability that could have allowed unauthenticated attackers to take over user accounts via cross-site scripting (XSS) attacks. The security flaw, identified as CVE-2024-4835, is an XSS weakness in the VS code editor (Web IDE) that could have enabled threat actors to steal restricted information using maliciously crafted pages.
Although this vulnerability could be exploited in attacks that don't require authentication, user interaction was still necessary, thereby increasing the complexity of the attacks. "Today, we are releasing versions 17.0.1, 16.11.3, and 16.10.6 for GitLab Community Edition (CE) and Enterprise Edition (EE)," GitLab announced. "These versions contain important bug and security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately."
On Wednesday, GitLab also addressed six other medium-severity security flaws, including a Cross-Site Request Forgery (CSRF) via the Kubernetes Agent Server (CVE-2023-7045) and a denial-of-service bug that could have allowed attackers to disrupt the loading of GitLab web resources (CVE-2024-2874).
Hijacked GitLab accounts could have a significant impact, including supply chain attacks, if the attackers insert malicious code in CI/CD (Continuous Integration/Continuous Deployment) environments, compromising an organization's repositories. As CISA warned earlier this month, threat actors are now actively exploiting another zero-click account hijacking vulnerability patched by GitLab in January.
Tracked as CVE-2023-7028, this maximum severity security flaw allows unauthenticated attackers to take over GitLab accounts via password resets. Despite Shadowserver discovering over 5,300 vulnerable GitLab instances exposed online in January, less than half (2,084) are still reachable at the moment. CISA added CVE-2023-7028 to its Known Exploited Vulnerabilities Catalog on May 1, ordering U.S. federal agencies to secure their systems within three weeks by May 22.
