The first of these vulnerabilities could allow an adversary to view internal resources when accessing the Grafana dashboard via hard-coded credentials. The vulnerability reported by Michael Gernoth has received CVE ID CVE-2019-14943. It affected the GitLab CE/EE versions 12.0 and later.
The second problem existed due to “Improper parameter sanitization on Gitaly”. Assigned as CVE-2019-14944, the flaw could give rise to numerous remote code execution and privilege escalation vulnerabilities. This problem affected GitLab CE/EE versions 10.0 and later.
GitLab has credited William Bowling (vakzz) for reporting this flaw. It also seems that this vulnerability made the researcher win a bounty of $12,000, as visible on his HackerOne account.
Another major security problem, CVE-2019-14942, targeted GitLab CE/EE versions 11.5 and later. Regarding this vulnerability, GitLab stated in the advisory,
Authentication cookies on GitLab Pages with Access Control could be sent over HTTP and weren't properly encrypted, which made them vulnerable to Man-In-The-Middle attacks.
Basic authentication and hard-coded admin credentials are now disabled by default in the bundled Grafana instance as part of the Omnibus-based GitLab packages. This change forces GitLab SSO to be the only authentication method, creates a backup of existing data, and resets the Grafana configuration to the GitLab default.The patched versions include GitLab Community Edition (CE) and Enterprise Edition (EE) versions 12.1.6, 12.0.6, and 11.11.8 respectively.
For now, GitLab has committed to publicly disclosing the vulnerability details in about one month. However, users must ensure they update their systems immediately with the patched versions to ensure they are protected.
Take your time to comment on this article.
