Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability was identified in GitLab that could allow unauthorized users to access sensitive files on the server. This issue stems from how the system handles requests to its repository commits API. The main concern is confirming if your GitLab instances are affected and understanding the potential exposure.
- Unauthenticated users could read server files.
- This vulnerability impacts a widely used code collaboration platform.
- Confirm relevance and potential exposure for GitLab instances.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this vulnerability by interacting with the repository commits API. This component, when improperly configured or when path confinement and authentication checks are bypassed, allows for the reading of arbitrary files from the GitLab server.
- No authentication required.
- Access repository commits API.
- Read arbitrary files.
Live Threat
Current exploitation, exposure, and threat context
Under certain conditions, an unauthenticated user could read arbitrary files from a GitLab server. This could occur when the repository commits API is accessed, potentially exposing sensitive system or user data.
- Arbitrary file contents.
- Through repository commits API.
- Unauthorized data disclosure.
Operational Fix
Recommended remediation, mitigation, and detection steps
This critical vulnerability impacts GitLab CE/EE, potentially allowing unauthenticated users to read arbitrary files. Platform or infrastructure teams managing GitLab instances are likely responsible for remediation. The first step is to identify all deployed GitLab instances, confirm their exposure and business criticality, and then engage the appropriate owner to plan remediation based on risk.
- Confirm GitLab instance ownership and exposure.
- Verify instance reachability and business criticality.
- Plan remediation based on risk and vendor guidance.
