Critical · published October 17, 2022
CVSS calls it critical at 9.9. It sits in the 99.5th percentile for exploit probability.
🚨 An authenticated user can execute arbitrary code through the GitHub Import API—kinda like a barista accepting orders from the wrong coffee shop! 🔥 Think of this vulnerability as a barista who takes orders without checking the source. If someone slips in a wild request from an unverified cafe, they could serve up all sorts of mischief instead of your beloved espresso. This means an attacker could hijack your server, tailoring commands to their heart's content—reading sensitive data, installing malware, or worse! The ramifications are absolutely devastating, potentially affecting the integrity and confidentiality of your entire GitLab instance.
Think of this vulnerability as a barista who takes orders without checking the source. If someone slips in a wild request from an unverified cafe, they could serve up all sorts of mischief instead of your beloved espresso. The flaw lies in how authenticated users can exploit the Import from GitHub API endpoint to run unauthorized commands remotely, which shouldn't be allowed under normal circumstances.
This means an attacker could hijack your server, tailoring commands to their heart's content—reading sensitive data, installing malware, or worse! The ramifications are absolutely devastating, potentially affecting the integrity and confidentiality of your entire GitLab instance. You must patch your GitLab instance to versions 15.1.5, 15.2.4, or 15.3.2 immediately. It's crucial to review your user access policies as well to limit who can access the API and perform imports. You've got this! Just follow these steps and your GitLab will be back on the path to safety in no time. 🛡️