GitLab Strikes Multiple Critical Vulnerabilities – Patch Now

GitLab has just issued a series of security bulletins that expose several critical vulnerabilities affecting both its Community Edition (CE) and Enterprise Edition (EE). The French CERT (CERT‑FR) has issued an urgent alert, warning that exploitation is straightforward and that public exploit code is likely to surface in the coming hours.

CVE‑2024‑0402 – Authenticated File‑Write

This flaw, scored 9.9 on CVSSv3, allows an attacker who has already authenticated to the platform to write files to any location on the server. The impact is severe: compromised configuration files, malicious scripts, or backdoors can be dropped, leading to full system takeover.

• Versions affected: 16.1.x < 16.1.6, 16.2.x < 16.2.9, 16.3.x < 16.3.7, 16.4.x < 16.4.5, 16.5.x < 16.5.8, 16.6.x < 16.6.6, 16.7.x < 16.7.4, 16.8.x < 16.8.1
• Fix: Upgrade to any GitLab release 16.5.6, 16.6.4, 16.7.2, or newer.

CVE‑2023‑7028 – Unauthenticated Password‑Reset Abuse

Scoring a perfect 10 on CVSSv3, this vulnerability lets an attacker send a password‑reset email to any address via a simple HTTP POST to the "/users/password" endpoint. By knowing a target’s email, an attacker can hijack the account without prior authentication.

• Versions affected: same as above.
• Fix: Apply the January 11, 2024 security release (GitLab 16.7.2) or any later patch.

"Exploitation is trivial and public exploits are expected to appear soon." – CERT‑FR Advisory

Immediate Actions

• Apply the latest GitLab patches without delay.
• Enable multi‑factor authentication (MFA) on all privileged accounts.
• Monitor the gitlab-rails/production_json.log for POST requests to "/users/password" that reference multiple email addresses.
• Check gitlab-rails/audit_json.log for entries with the controller PasswordsController#create and suspicious target_details arrays.
• Avoid using the interim releases 16.5.6, 16.6.4, and 16.7.2 until a newer stable version is available.

Organizations running GitLab should act immediately. The combination of authenticated file‑write and unauthenticated password‑reset abuse presents a low‑effort, high‑impact attack vector that could compromise entire infrastructures.