identity-authentication-vulnerabilitywidely-deployed-product-advisorypatch-regressioninternet-facing-service-vulnerability

GitLab patches critical password reset account takeover flaw

Vulnerability Disclosure · 5 sources · Updated 3mo ago · First seen Jan 11, 2024

GitLab released security updates for Community Edition and Enterprise Edition to fix multiple vulnerabilities, led by CVE-2023-7028, a critical password reset flaw that could send reset emails to an unverified address and enable account takeover. The issue was assigned a CVSS 10.0 score, and GitLab said GitLab.com had already been patched while it had not detected abuse of the flaw on GitLab-managed platforms. The same release also addressed CVE-2023-5356, which involved abuse of Slack and Mattermost slash commands, along with CVE-2023-4812, CVE-2023-6955, and CVE-2023-2030.

GitLab initially shipped fixes in versions 16.7.2, 16.6.4, and 16.5.6, then advised customers to move to 16.7.3, 16.6.5, 16.5.7, or newer because of an additional database migration issue in the earlier patch set. The company urged self-managed administrators to upgrade promptly, enable 2FA, and review logs for signs of exploitation attempts, reflecting the severity of the account takeover risk and the broader exposure from the other patched flaws.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jan 11, 2024

Reported Jan 15, 20243y ago
Dutch NCSC observes active exploitation attempts of GitLab flaws
The Dutch National Cyber Security Centre (NCSC) reported observing active attempts to exploit GitLab vulnerabilities, including CVE-2023-7028. The advisory also noted that public proof-of-concept exploit code had been published.
Kritieke beveiligingslekken in GitLab | NCSC
Jan 11, 20243y ago
GitLab advises customers to upgrade beyond initial January patch set
After the 2024-01-11 security release, GitLab later told customers to upgrade further to versions 16.7.3, 16.6.5, 16.5.7, or newer because the earlier patch set had an additional DB migration issue. The source does not provide a specific date for this follow-up advisory.
GitLab Critical Security Release: 16.7.2, 16.6.4, 16.5.6 | GitLab Docs
Jan 11, 20243y ago
GitLab releases security updates fixing CVE-2023-7028 and other flaws
On 2024-01-11, GitLab released versions 16.7.2, 16.6.4, and 16.5.6 for Community Edition and Enterprise Edition to fix multiple vulnerabilities, including the critical account takeover issue CVE-2023-7028. The release also addressed CVE-2023-5356, CVE-2023-4812, CVE-2023-6955, and CVE-2023-2030, and GitLab said GitLab.com was already patched.
GitLab Critical Security Release: 16.7.2, 16.6.4, 16.5.6 | GitLab Docs

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

5 linked

GitLab Signed Commit Metadata Validation Bypass (CVE-2023-2030)GitLab CE/EE Password Reset Account Takeover (CVE-2023-7028)Improper access control in GitLab Workspaces cross-group agent association (CVE-2023-6955)GitLab CE/EE Slack and Mattermost Slash Command Impersonation (CVE-2023-5356)GitLab EE CODEOWNERS Approval Bypass (CVE-2023-4812)

Affected products

2 linked

Gitlab Community EditionGitlab Enterprise Edition

Organizations

1 linked

GitLab

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

5 references tracked. Mallory keeps watching after this page renders.

Ncsc Nl NewsNews · Jan 15, 2024

Kritieke beveiligingslekken in GitLab | NCSCOpen source ↗

Gitlab ReleasesNews · Jan 11, 2024

GitLab Critical Security Release: 16.7.2, 16.6.4, 16.5.6 | GitLab DocsOpen source ↗

Cve MitreAdvisories

CVE Record: CVE-2023-5356Open source ↗

Cve MitreAdvisories

CVE Record: CVE-2023-7028Open source ↗

Gitlab ReleasesNews

Gitlab ReleasesOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

GitLab patches critical password reset account takeover flaw

How this story unfolded

Dutch NCSC observes active exploitation attempts of GitLab flaws

GitLab advises customers to upgrade beyond initial January patch set

GitLab releases security updates fixing CVE-2023-7028 and other flaws

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

GitLab patches 11 flaws including account takeover and XSS in CE and EE

GitLab Patches High-Severity 2FA Bypass and DoS Vulnerabilities in CE/EE

GitLab patches multiple flaws including XSS and GitLab EE authorization bypass

GitLab patches critical password reset account takeover flaw

How this story unfolded

Dutch NCSC observes active exploitation attempts of GitLab flaws

GitLab advises customers to upgrade beyond initial January patch set

GitLab releases security updates fixing CVE-2023-7028 and other flaws

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

GitLab patches 11 flaws including account takeover and XSS in CE and EE

GitLab Patches High-Severity 2FA Bypass and DoS Vulnerabilities in CE/EE

GitLab patches multiple flaws including XSS and GitLab EE authorization bypass