background:
GitLab officially released a security advisory, fixing one of the GitLab Community Edition (CE) and Enterprise Edition (EE)Remote code execution vulnerability(CVE-2022-2884) This vulnerability allows authenticated users to achieve remote code execution by importing from the GitHub API endpoint. An attacker who successfully exploits this vulnerability can gain server privileges.
Affected versions:
GitLab CE/EE 15.3 version: < 15.3.1
GitLab CE/EE 15.2 version: < 15.2.3
GitLab CE/EE 15.1 version: < 15.1.5
Exploit:
At present, the details of the vulnerability and the test code have not been made public, but malicious attackers can compare and analyze the vulnerability trigger points. Affected users are advised to update security patches in a timely manner.
Repair suggestions:
The official security version has been released and it is recommended to upgrade to the security version.
https://about.gitlab.com/update/
https://about.gitlab.com/releases/2022/08/22/critical-security-release-gitlab-15-3-1-released/
Original article by Chief Security Officer, if reproduced, please credit https://www.cncso.com/en/gitlab-devops-platform-rce-vulnerability.html
