SB2021100403 - Multiple vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE)
Published: October 4, 2021 Updated: October 5, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 31 secuirty vulnerabilities.
1) Stored cross-site scripting (CVE-ID: CVE-2021-39885)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in merge request creation page. A remote authenticated attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
2) Resource exhaustion (CVE-ID: CVE-2021-39877)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in Markdown parser. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
3) Stored cross-site scripting (CVE-ID: CVE-2021-39887)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the GitLab Flavored Markdown. A remote authenticated attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
4) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2021-39867)
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to DNS Rebinding issue in Gitea importer. A remote authenticated attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
5) Information disclosure (CVE-ID: CVE-2021-39869)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote attacker can gain unauthorized access to sensitive information on the system.
6) Improper access control (CVE-ID: CVE-2021-39872)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote authenticated attacker with expired password can still access GitLab through git and API through access tokens acquired before password expiration.
7) Information disclosure (CVE-ID: CVE-2021-39891)
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation. A remote administrator can gain unauthorized access to sensitive information on the system.
8) Cross-site scripting (CVE-ID: CVE-2021-39878)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the Jira integration. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
9) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2021-39894)
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to the DNS Rebinding issue in Fogbugz importer. A remote authenticated attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
10) Business Logic Errors (CVE-ID: CVE-2021-39866)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to a business logic error in the project deletion process. A remote authenticated attacker can use persistent access via project access tokens.
11) Information disclosure (CVE-ID: CVE-2021-39882)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote attacker can gain unauthorized access to sensitive information on the system.
12) Input validation error (CVE-ID: CVE-2021-39893)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
13) Information disclosure (CVE-ID: CVE-2021-39875)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote attacker can see pending invitations of any public group or public project by visiting an API endpoint.
14) Security features bypass (CVE-ID: CVE-2021-39870)
The vulnerability allows a remote attacker to bypass security features on the system.
The vulnerability exists due to a security features bypass in an instance that has the setting to disable Repo by URL import enabled. A remote authenticated attacer can make a crafted API call.
15) Information disclosure (CVE-ID: CVE-2021-39884)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote authenticated attacker can see names of the private groups shared in projects.
16) Information disclosure (CVE-ID: CVE-2021-39888)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a specific API endpoint may reveal details about a private group and other sensitive info inside issue and merge request templates. A remote authenticated attacker can gain unauthorized access to sensitive information on the system.
17) Improper Authorization (CVE-ID: CVE-2021-39883)
The vulnerability allows a remote attacker to bypass authorization checks.
The vulnerability exists due to improper authorization. A remote authenticated attacker can bypass authentication process and see epics from all parent subgroups.
18) Information disclosure (CVE-ID: CVE-2021-39889)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to an insecure direct object reference (IDOR) issue. A remote authenticated attacker can make a specially crafted API call with the ID of the protected branch and disclose the protected branch name.
19) Information disclosure (CVE-ID: CVE-2021-39900)
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in SendEntry. A remote administrator can gain unauthorized access to sensitive information on the system.
20) Improper Authentication (CVE-ID: CVE-2021-39879)
The vulnerability allows a local user to bypass authentication process.
The vulnerability exists due to an error in when processing authentication requests. A local user can disable two-factor authentication.
21) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-39886)
The vulnerability allows a remote attacker to gain access to sensitive information on the system.
The vulnerability exists due to the permissions rules were not applied while issues were moved between projects of the same group. A remote authenticated attacker can read confidential Epic references.
22) Insufficient Session Expiration (CVE-ID: CVE-2021-39899)
The vulnerability allows a local attacker to gain access to sensitive information.
The vulnerability exists due to lack of account lockout on change password functionality. An attacker with physical access can brute force the user’s password.
23) Security features bypass (CVE-ID: CVE-2021-39890)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to security features bypass issue. A remote authenticated attacker can bypass 2FA and access some specific pages with Basic Authentication.
24) Security features bypass (CVE-ID: CVE-2021-39881)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the application may let a malicious user create an OAuth client application with arbitrary scope names. A remote authenticated attacker can trick a victim to authorize the malicious client application using the spoofed scope name and description.
25) Insufficient Session Expiration (CVE-ID: CVE-2021-39896)
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to improper session management in impersonation feature. A remote administrator can use the impersonate feature twice and stops impersonating, the admin may be logged in as the second user they impersonated, which may lead to repudiation issues.
26) Spoofing attack (CVE-ID: CVE-2021-39873)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data. A remote attacker can spoof page content.
27) Security features bypass (CVE-ID: CVE-2021-39874)
The vulnerability allows a remote authenticated attacker to compromise the target system.
The vulnerability exists due to the requirement to enforce 2FA is not honored when using git commands.
28) Security features bypass (CVE-ID: CVE-2021-39871)
The vulnerability allows a remote attacker to bypass security features on the system.
The vulnerability exists due to a security features bypass in an instance that has the setting to disable Bitbucket Server import enabled. A remote authenticated attacer can make a crafted API call.
29) Improper access control (CVE-ID: CVE-2021-39868)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote authenticated attacker can create a project with unlimited repository size by modifying values in a project export.
30) Input validation error (CVE-ID: CVE-2021-22259)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to lack of pagination in dependencies API. A remote authenticated attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
31) Information disclosure (CVE-ID: CVE-2021-39892)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote authenticated attacker can can import users from projects that they are not a maintainer on and disclose email addresses of those users.
Remediation
Install update from vendor's website.