GitLab has shipped security patches to resolve a critical flaw that allows an attacker to run pipelines as another user.
The issue, tracked as CVE-2023-5009 (CVSS score: 9.6), impacts all versions of GitLab Enterprise Edition (EE) starting from 13.12 and prior to 16.2.7 as well as from 16.3 and before 16.3.4.
“It was possible for an attacker to run pipelines as an arbitrary user via scheduled security scan policies,” GitLab said in an advisory. “This was a bypass of CVE-2023-3932 showing additional impact.”
Successful exploitation of CVE-2023-5009 could allow a threat actor to access sensitive information or leverage the elevated permissions of the impersonated user to modify source code or run arbitrary code on the system, leading to severe consequences.
Security researcher Johan Carlsson (aka joaxcar) has been credited with discovering and reporting the flaw. CVE-2023-3932 was addressed by GitLab in early August 2023.
The vulnerability has been addressed in GitLab versions 16.3.4 and 16.2.7.
Level-Up SaaS Security: A Comprehensive Guide to ITDR and SSPM
Stay ahead with actionable insights on how ITDR identifies and mitigates threats. Learn about the indispensable role of SSPM in ensuring your identity remains unbreachable.
The disclosure comes as a two-year-old critical GitLab bug (CVE-2021-22205, CVSS score: 10.0) continues to be actively exploited by threat actors in real-world attacks.
Earlier this week, Trend Micro revealed that a China-linked adversary known as Earth Lusca is aggressively targeting public-facing servers by weaponizing N-day security flaws, including CVE-2021-22205, to infiltrate victim networks.
It’s highly recommended that users update their GitLab installations to the latest version as soon as possible to safeguard against potential risks.