Loading vulnerability…
GitLab CE/EE Slack and Mattermost Slash Command Impersonation
CVE-2023-5356 is an incorrect authorization vulnerability in GitLab Community Edition and Enterprise Edition that affects all versions from 8.13 before 16.5.6, 16.6 before 16.6.4, and 16.7 before 16.7.2. The flaw resides in authorization handling for Slack and Mattermost integrations and allows a user to abuse slash-command functionality so that commands are executed as another GitLab user. This results in an impersonation condition within integrated chat-driven workflows, where GitLab incorrectly attributes and processes slash-command actions under the identity of a different user than the actual requester.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker with the ability to interact with the affected Slack or Mattermost integration to execute GitLab slash commands as another user. Depending on the permissions of the impersonated user and the available slash-command actions, this can lead to unauthorized actions in GitLab, misuse of project or administrative workflows, and access to operations or data that should be restricted to the victim user. The primary security impact is privilege misuse through user impersonation within integrated collaboration workflows.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling or restricting Slack and Mattermost integrations that provide slash-command access, limiting which users and channels can invoke those integrations, and reviewing permissions associated with chat-driven GitLab actions. Monitor audit and integration activity for unexpected slash-command execution attributed to users who did not initiate the action. These measures only reduce risk; vendor patching is the definitive fix.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed version. The vulnerability is addressed in 16.5.6, 16.6.4, and 16.7.2, and later updates are also available in subsequent patched releases. For environments on supported branches, move to the latest vendor-recommended release for that branch or newer.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.