14 ms·

Gitlab Critical Security Release: 16.3.4 and 16.2.7

96 points by mirzap 3y ago

decasia 3y ago
It's always a little unexpected when the security vulnerabilities are in the tools we use to build software instead of just in the software. I suppose it's a class of supply chain vulnerability. In this particular class of impersonation problem (the Gitlab issue is about running a pipeline as another user), sometimes I find it unnerving how much an attacker could accomplish in a software company by being able to impersonate an arbitrary Slack user. We are taught to be cautious around incoming email, but I've yet to see a security training around "how do you know that your instant messages are genuine."
- thejosh 3y ago
  session tokens are a fun one, that's how Linus Tech Tips (tech Youtuber) and other Youtubers got their accounts yoinked.
  - zx8080 3y ago
    Mind sharing links on what's happened?
    - FirmwareBurner 3y ago
      Someone from the staff opened a pdf with malware sich stole their Session tokens and bam.
      - Operyl 3y ago
        Wasn’t a PDF, straight up just regular exe. Their business unit aren’t “techies” per se like the rest of them.
        blackjpi 3y ago
        In fairness, it was file extension spoofed[1] exe made to look like a PDF file. When sent to someone who frequently downloads and opens PDFs as part of their job, it would be a very easy mistake to make, especially for the unaware to this attack vector. [1] https://www.malwarebytes.com/blog/news/2016/09/lesser-known-tricks-of-spoofing-extensions https://www.malwarebytes.com/blog/news/2016/09/lesser-known-...
        Operyl 3y ago
        Yup, just clarifying that it wasn’t some crazy PDF reader exploit (which would have been kinda amazing).
        tyingq 3y ago
        > some crazy PDF reader exploit One of those: https://6point6.co.uk/insights/abusing-pdf-files/ https://6point6.co.uk/insights/abusing-pdf-files/
- deleted 3y ago
  [deleted]
- kawsper 3y ago
  This happened to us using Flowdock (a Slack competitor), they had a main DB failure, and when a new one was promoted the state was bad, and so "new" employees from another company started appearing in our organisation replacing our own employees, they could then read our private messages and access our rooms. https://web.archive.org/web/20220704223244/https://flowdock-resources.s3.amazonaws.com/legal/Flowdock-RCA-For-Incident-On-2020-04-21.pdf https://web.archive.org/web/20220704223244/https://flowdock-... It was really hard for me to find a responsible from Flowdock/Broadcom/Rally Software/CA Technologies to report the leak, but in the end they killed the servers until they got the issues under control. Because of this I mostly share encrypted files over chat, using OpenPGP, but the user experience is terrible for most :(
  - wiktor-k 3y ago
    Wow, that's really disturbing. > Because of this I mostly share encrypted files over chat, using OpenPGP, but the user experience is terrible for most :( Agreed. Even with builtin OpenPGP support in Thunderbird the UX is still bad for regular users (well, for technical ones too).
infocollector 3y ago
Not sure if anyone here is hanging out from Gitlab. One request, and one question: Request: The new UI has "Admin" link hidden which is hard to find. I liked the old UI better (explicit is better than implicit). Question: Is the open source code the same as the Enterprise versions of the code? (how do you implement feature differences?)
- roblabla 3y ago
  There's now a single codebase containing both enterprise and FOSS. Enterprise features live in the `ee/` subfolder of the repository. This allows them to share code. (EE used to be a (visible-source) fork of CE, but the repos got merged like a year or so ago).
- dnsmichi 3y ago
  GitLab team member here. Thanks for your feedback. > Request: The new UI has "Admin" link hidden which is hard to find. I liked the old UI better (explicit is better than implicit). This was reported in the new navigation feedback issue [0] and is being worked on in [1]. Suggest adding your comment/upvote there too. > Question: Is the open source code the same as the Enterprise versions of the code? (how do you implement feature differences?) The source code for GitLab is located in a single repository. The change was proposed and introduced in 2019 for efficiency reasons [2] [3] [4] You can learn more about the stewardship of GitLab, and the promises in [5] - point 11) links to the enterprise code location, and the free open source location. This workflow also ensures that everyone can contribute to GitLab [6] - free users, and customers [7], using the same code base. [0] https://gitlab.com/gitlab-org/gitlab/-/issues/409005#what-weve-started-looking-in-to https://gitlab.com/gitlab-org/gitlab/-/issues/409005#what-we... [1] https://gitlab.com/gitlab-org/gitlab/-/issues/415854 https://gitlab.com/gitlab-org/gitlab/-/issues/415854 [2] https://about.gitlab.com/blog/2019/02/21/merging-ce-and-ee-codebases/ https://about.gitlab.com/blog/2019/02/21/merging-ce-and-ee-c... [3] https://about.gitlab.com/blog/2019/08/23/a-single-codebase-for-gitlab-community-and-enterprise-edition/ https://about.gitlab.com/blog/2019/08/23/a-single-codebase-f... [4] https://about.gitlab.com/blog/2019/10/02/contributor-after-single-code-base/ https://about.gitlab.com/blog/2019/10/02/contributor-after-s... [5] https://handbook.gitlab.com/handbook/company/stewardship/#promises https://handbook.gitlab.com/handbook/company/stewardship/#pr... [6] https://about.gitlab.com/community/contribute/ https://about.gitlab.com/community/contribute/ [7] https://docs.gitlab.com/ee/development/contributing/#contributing-to-premiumultimate-features-with-an-enterprise-edition-license https://docs.gitlab.com/ee/development/contributing/#contrib...
gizmo 3y ago
This is the original issue thread from two months ago: https://gitlab.com/gitlab-org/gitlab/-/issues/417594 https://gitlab.com/gitlab-org/gitlab/-/issues/417594 And the root cause seems to be... > Change your git config and include username of the your victim that is, > git config --global user.name "victim" Oops.
- prmoustache 3y ago
  This is not the root cause but the way to exploit it imho. The root cause was that the pipeline process would reuse CI tokens that gives access to other repos/projects just by being added as member on someone else's repo and being formally marked as user in a commit.
  - plagiarist 3y ago
    Wow. That kind of decision does not inspire confidence in the product.
    - hoseja 3y ago
      What is the vulnerability here? Being an asshole to a co-member on a project? What I'm saying is, this seems like a place of mutual trust, no apparent reason to be especially hardened.
      - tyingq 3y ago
        No, it works cross project, with no specific need for the victim to do anything dumb. And the attacker needs no rights to the victim target repo. You end up with an active CI_JOB_TOKEN that impersonates the victim. It's pretty bad.
      - kelnos 3y ago
        No, the issue is that a random attacker can create a group, and add the victim to the group themselves, and that gives them access to the victim's private repos, albeit through a pretty convoluted execution path.
glintik 3y ago
Oh, critical issue again. Looks like Gitlab needs security officer to help to prevent this.
- rtev 3y ago
  The reason you see so many critical Gitlab security fixes is because they take security so seriously. They pay huge bounties for security vulnerabilities in their products, so they get the best researchers responsibly disclosing bugs.
  - skc 3y ago
    This sounds like bias. Replace "Gitlab" with "Microsoft" or "Oracle" in your comment and I'd wager you'd feel differently.
    - rtev 3y ago
      I don’t think it is. Microsoft has a track record for delaying fixes and marking important issues as “not a bug”, so I’m less impressed with their security. As terrible a corporation as Oracle is, their security response team has been one of the most effective and fast-paced I’ve ever reported to. With that said, they pay nothing to researchers, so Gitlab certainly shows they care more about security.
  - glintik 3y ago
    Nice hypothesis, but far away from the reality
  - mattl 3y ago
    GitLab also releases very frequently, minimum once a month with a whole new release. Between releases usually two or three updates but occasionally more.
yellowsir 3y ago
I wonder why is this on HN. Gitlab has like 10 Security releases/year, this is the first i see on HN. If you self host gitlab you should be subscribed to the security newsletter. It would save a lot of time on my end, if gitlab had a :stable release tag for docker.
- remram 3y ago
  Direct link: https://about.gitlab.com/company/contact/ https://about.gitlab.com/company/contact/ Scroll down to "Sign up for security notices"
deleted 3y ago
[deleted]

96 points by mirzap 3y ago

It's always a little unexpected when the security vulnerabilities are in the tools we use to build software instead of just in the software. I suppose it's a class of supply chain vulnerability. In this particular class of impersonation problem (the Gitlab issue is about running a pipeline as another user), sometimes I find it unnerving how much an attacker could accomplish in a software company by being able to impersonate an arbitrary Slack user. We are taught to be cautious around incoming email, but I've yet to see a security training around "how do you know that your instant messages are genuine."

thejosh 3y ago
session tokens are a fun one, that's how Linus Tech Tips (tech Youtuber) and other Youtubers got their accounts yoinked.
- zx8080 3y ago
  Mind sharing links on what's happened?
  - FirmwareBurner 3y ago
    Someone from the staff opened a pdf with malware sich stole their Session tokens and bam.
    - Operyl 3y ago
      Wasn’t a PDF, straight up just regular exe. Their business unit aren’t “techies” per se like the rest of them.
      - blackjpi 3y ago
        In fairness, it was file extension spoofed[1] exe made to look like a PDF file. When sent to someone who frequently downloads and opens PDFs as part of their job, it would be a very easy mistake to make, especially for the unaware to this attack vector. [1] https://www.malwarebytes.com/blog/news/2016/09/lesser-known-tricks-of-spoofing-extensions https://www.malwarebytes.com/blog/news/2016/09/lesser-known-...
        Operyl 3y ago
        Yup, just clarifying that it wasn’t some crazy PDF reader exploit (which would have been kinda amazing).
        tyingq 3y ago
        > some crazy PDF reader exploit One of those: https://6point6.co.uk/insights/abusing-pdf-files/ https://6point6.co.uk/insights/abusing-pdf-files/
deleted 3y ago
[deleted]
kawsper 3y ago
This happened to us using Flowdock (a Slack competitor), they had a main DB failure, and when a new one was promoted the state was bad, and so "new" employees from another company started appearing in our organisation replacing our own employees, they could then read our private messages and access our rooms. https://web.archive.org/web/20220704223244/https://flowdock-resources.s3.amazonaws.com/legal/Flowdock-RCA-For-Incident-On-2020-04-21.pdf https://web.archive.org/web/20220704223244/https://flowdock-... It was really hard for me to find a responsible from Flowdock/Broadcom/Rally Software/CA Technologies to report the leak, but in the end they killed the servers until they got the issues under control. Because of this I mostly share encrypted files over chat, using OpenPGP, but the user experience is terrible for most :(
- wiktor-k 3y ago
  Wow, that's really disturbing. > Because of this I mostly share encrypted files over chat, using OpenPGP, but the user experience is terrible for most :( Agreed. Even with builtin OpenPGP support in Thunderbird the UX is still bad for regular users (well, for technical ones too).

infocollector 3y ago

Not sure if anyone here is hanging out from Gitlab. One request, and one question: Request: The new UI has "Admin" link hidden which is hard to find. I liked the old UI better (explicit is better than implicit). Question: Is the open source code the same as the Enterprise versions of the code? (how do you implement feature differences?)

roblabla 3y ago
There's now a single codebase containing both enterprise and FOSS. Enterprise features live in the `ee/` subfolder of the repository. This allows them to share code. (EE used to be a (visible-source) fork of CE, but the repos got merged like a year or so ago).
dnsmichi 3y ago
GitLab team member here. Thanks for your feedback. > Request: The new UI has "Admin" link hidden which is hard to find. I liked the old UI better (explicit is better than implicit). This was reported in the new navigation feedback issue [0] and is being worked on in [1]. Suggest adding your comment/upvote there too. > Question: Is the open source code the same as the Enterprise versions of the code? (how do you implement feature differences?) The source code for GitLab is located in a single repository. The change was proposed and introduced in 2019 for efficiency reasons [2] [3] [4] You can learn more about the stewardship of GitLab, and the promises in [5] - point 11) links to the enterprise code location, and the free open source location. This workflow also ensures that everyone can contribute to GitLab [6] - free users, and customers [7], using the same code base. [0] https://gitlab.com/gitlab-org/gitlab/-/issues/409005#what-weve-started-looking-in-to https://gitlab.com/gitlab-org/gitlab/-/issues/409005#what-we... [1] https://gitlab.com/gitlab-org/gitlab/-/issues/415854 https://gitlab.com/gitlab-org/gitlab/-/issues/415854 [2] https://about.gitlab.com/blog/2019/02/21/merging-ce-and-ee-codebases/ https://about.gitlab.com/blog/2019/02/21/merging-ce-and-ee-c... [3] https://about.gitlab.com/blog/2019/08/23/a-single-codebase-for-gitlab-community-and-enterprise-edition/ https://about.gitlab.com/blog/2019/08/23/a-single-codebase-f... [4] https://about.gitlab.com/blog/2019/10/02/contributor-after-single-code-base/ https://about.gitlab.com/blog/2019/10/02/contributor-after-s... [5] https://handbook.gitlab.com/handbook/company/stewardship/#promises https://handbook.gitlab.com/handbook/company/stewardship/#pr... [6] https://about.gitlab.com/community/contribute/ https://about.gitlab.com/community/contribute/ [7] https://docs.gitlab.com/ee/development/contributing/#contributing-to-premiumultimate-features-with-an-enterprise-edition-license https://docs.gitlab.com/ee/development/contributing/#contrib...

gizmo 3y ago

This is the original issue thread from two months ago: https://gitlab.com/gitlab-org/gitlab/-/issues/417594 https://gitlab.com/gitlab-org/gitlab/-/issues/417594 And the root cause seems to be... > Change your git config and include username of the your victim that is, > git config --global user.name "victim" Oops.

prmoustache 3y ago
This is not the root cause but the way to exploit it imho. The root cause was that the pipeline process would reuse CI tokens that gives access to other repos/projects just by being added as member on someone else's repo and being formally marked as user in a commit.
- plagiarist 3y ago
  Wow. That kind of decision does not inspire confidence in the product.
  - hoseja 3y ago
    What is the vulnerability here? Being an asshole to a co-member on a project? What I'm saying is, this seems like a place of mutual trust, no apparent reason to be especially hardened.
    - tyingq 3y ago
      No, it works cross project, with no specific need for the victim to do anything dumb. And the attacker needs no rights to the victim target repo. You end up with an active CI_JOB_TOKEN that impersonates the victim. It's pretty bad.
    - kelnos 3y ago
      No, the issue is that a random attacker can create a group, and add the victim to the group themselves, and that gives them access to the victim's private repos, albeit through a pretty convoluted execution path.

glintik 3y ago

Oh, critical issue again. Looks like Gitlab needs security officer to help to prevent this.

rtev 3y ago
The reason you see so many critical Gitlab security fixes is because they take security so seriously. They pay huge bounties for security vulnerabilities in their products, so they get the best researchers responsibly disclosing bugs.
- skc 3y ago
  This sounds like bias. Replace "Gitlab" with "Microsoft" or "Oracle" in your comment and I'd wager you'd feel differently.
  - rtev 3y ago
    I don’t think it is. Microsoft has a track record for delaying fixes and marking important issues as “not a bug”, so I’m less impressed with their security. As terrible a corporation as Oracle is, their security response team has been one of the most effective and fast-paced I’ve ever reported to. With that said, they pay nothing to researchers, so Gitlab certainly shows they care more about security.
- glintik 3y ago
  Nice hypothesis, but far away from the reality
- mattl 3y ago
  GitLab also releases very frequently, minimum once a month with a whole new release. Between releases usually two or three updates but occasionally more.

yellowsir 3y ago

I wonder why is this on HN. Gitlab has like 10 Security releases/year, this is the first i see on HN. If you self host gitlab you should be subscribed to the security newsletter. It would save a lot of time on my end, if gitlab had a :stable release tag for docker.

remram 3y ago
Direct link: https://about.gitlab.com/company/contact/ https://about.gitlab.com/company/contact/ Scroll down to "Sign up for security notices"

deleted 3y ago

[deleted]