Loading vulnerability…
Arbitrary File Read via Project Import in GitLab
CVE-2023-3385 is a vulnerability in GitLab affecting versions from 8.10 up to but not including 16.0.8, 16.1 up to but not including 16.1.3, and 16.2 up to but not including 16.2.2. The vulnerability allows an attacker to access and read arbitrary files on the server by importing a project 'from export' with a specially crafted tar file. The issue is rooted in a bug in the tar utility (prior to version 1.35), which GitLab used for handling project imports.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker with the ability to import projects could exploit this vulnerability to read arbitrary files on the GitLab server, potentially exposing sensitive information such as configuration files, credentials, or other data outside the intended project scope.
If you can’t patch tonight, do this now.
Restrict project import permissions to trusted users only and monitor for suspicious import activity. Consider isolating the GitLab instance or running it in a hardened environment until the patch can be applied.
Patch, then assume compromise.
Upgrade GitLab to version 16.0.8, 16.1.3, 16.2.2 or later. Additionally, ensure that the underlying tar utility is updated to version 1.35 or later to address the root cause of the vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.