⚡ TL;DR | Go Straight to the GitLab Report
GitLab released a new version of their on-premise hosted version in response to a critical security vulnerability CVE-2022-2185. GitLab lists that the following versions are vulnerable:
- 14.0 prior to 14.10.5
- 15.0 prior to 15.0.4
- 15.1 prior to 15.1.1
CVE-2022-2185 received a CVSS base score of 9.9, getting awfully close to the perfect 10. The company says in its advisory that it “strongly recommends that all GitLab installations be upgraded to one of these versions immediately.”
The vulnerability lies in the GitLab project imports which can be exploited to achieve remote command execution. While not a lot of additional details are known, there is some discussion on whether it is truly an unauthenticated RCE or an authenticated RCE. However, at first glance, it does seem that an attacker would have to be authenticated and authorized to perform project imports in order to exploit the vulnerability.
The vulnerability was discovered by a bounty hunter nicknamed “vakzz” who used the HackerOne bug bounty program.
To help with mitigating the risk of this vulnerability as soon as possible, we’ve created a report to list all GitLab Linux software along with details like the version, description, install date, and more so you know where your GitLab installation is located and which version it is running.
