Summary: GitLab has issued a critical security update to address a high-severity vulnerability that could allow unauthorized access to Kubernetes clusters, affecting multiple versions of both the Community and Enterprise Editions. The update also addresses several other vulnerabilities, underscoring the importance of upgrading to the latest versions promptly.
Threat Actor: Unknown | unknown
Victim: GitLab Users | GitLab
Key Point :
- Critical vulnerability (CVE-2024-9693) allows unauthorized access to Kubernetes agent under specific configurations.
- Device OAuth flow vulnerability (CVE-2024-7404) could enable full API access for attackers.
- Denial of Service (DoS) vulnerability could be triggered by malicious content through the Fogbugz importer.
- Stored XSS vulnerability (CVE-2024-8648) allows injection of malicious JavaScript into Analytics Dashboards.
- HTML injection vulnerability (CVE-2024-8180) could lead to XSS attacks if Content Security Policy (CSP) is not enabled.
- Information disclosure vulnerability (CVE-2024-10240) may allow unauthenticated users to read private project merge requests.
GitLab has released a critical security update addressing a high-severity vulnerability that could grant unauthorized access to Kubernetes clusters. Versions 17.5.2, 17.4.4, and 17.3.7 of both the Community Edition (CE) and Enterprise Edition (EE) patch a total of six security flaws, including the critical Kubernetes issue and several other medium-severity vulnerabilities.
The most serious vulnerability (CVE-2024-9693) allows unauthorized access to the Kubernetes agent within a cluster under specific configurations. “This is a high severity issue (CVSS 8.5),” warns the GitLab security advisory. This vulnerability was discovered internally by GitLab team member Tiger Watson.
In addition to the Kubernetes flaw, GitLab patched several other vulnerabilities, including:
- Device OAuth flow vulnerability (CVE-2024-7404): This flaw could allow an attacker to gain full API access as the victim.
- Denial of Service (DoS) vulnerability: Maliciously crafted content imported using the Fogbugz importer could trigger a denial of service.
- Stored XSS vulnerability (CVE-2024-8648): Attackers could inject malicious JavaScript code into Analytics Dashboards through a specially crafted URL.
- HTML injection vulnerability (CVE-2024-8180): Improper output encoding could lead to cross-site scripting (XSS) attacks if Content Security Policy (CSP) is not enabled.
- Information disclosure vulnerability (CVE-2024-10240): An unauthenticated user could potentially read information about merge requests in private projects under specific circumstances.
GitLab urges all users to upgrade their self-managed installations to the latest versions immediately.
“We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible,” states the advisory.
Related Posts:
Source: https://securityonline.info/cve-2024-9693-gitlab-issues-critical-patch-for-kubernetes-agent