Dustin Decker

Gitlab Critical Zero-Day

GitLab has released security updates for both the Community and Enterprise Edition to address two critical vulnerabilities, one of them allowing account hijacking with no user interaction.

The most critical security issue GitLab patched has the maximum severity score (10 out of 10) and is being tracked as CVE-2023-7028. Successful exploitation does not require any interaction.

It is an authentication problem that permits password reset requests to be sent to arbitrary, unverified email addresses, allowing account takeover. If two-factor authentication (2FA) is active, it is possible to reset the password but the second authentication factor is still needed for successful login.

Hijacking a GitLab account can have a significant impact on an organization since the platform is typically used to host proprietary code, API keys and other sensitive data.

Another risk is that of supply chain attacks where attackers can compromise repositories by inserting malicious code in live environments when GitLab is used for CI/CD (Continuous Integration/Continuous Deployment).

GitLab and GitHub are both popular platforms for managing Git repositories, but they have distinct approaches to their codebases: 

  1. GitLab: 
  • GitLab uses a composable codebase architecture based on Rails engines. This means that different components of GitLab (such as the web interface, API, background jobs, etc.) are organized as separate modules within a single codebase. 
  • The GitLab Rails application is composed of various engines, each handling specific functionality. For example: 
  • gitlab_rails_web_controllers: Controllers for the web interface. 
  • gitlab_rails_api: API-related functionality. 
  • gitlab_rails_sidekiq: Background job workers. 
  • And more2. 
  • The database and Redis are shared across these engines. 
  • This approach allows GitLab to maintain a unified codebase while keeping different features modular and manageable. 
  1. GitHub: 
  • GitHub, on the other hand, does not share a common codebase in the same way as GitLab. 
  • GitHub’s codebase is not publicly available, but it is known that they use a monolithic architecture where all features are part of a single application. 
  • While GitHub does have separate repositories for different services (such as GitHub Actions, GitHub Pages, etc.), these are not separate codebases but rather tightly integrated components within the monolith. 

In summary, GitLab’s composable codebase approach allows for better separation of concerns while maintaining a single codebase, whereas GitHub follows a monolithic architecture with tightly integrated features2 4. 

Source(s) 

1. Composable GitLab Codebase | GitLab – GitLab Documentation 

2. GitLab vs GitHub: Major Differences and Similarities – Kinsta 

3. What if two Git repositories share common code – Stack Overflow 

4. Update: Why GitLab uses a single codebase for Community and Enterprise … 

Dustin Decker

Hello World! My name is Dustin Decker, and I am a full-time security researcher and student with over twenty years of experience as an information systems engineer. I am currently beginning my senior year pursuing my second bachelor’s degree in applied Cybersecurity (BACS) with the SANS Technology Institute. I anticipate graduating in May of 2024. I am a skilled Information Security Analyst with expertise in risk management framework (RMF), systems development life cycle (SDLC), security life cycle, management of a wide range of vulnerabilities and threats, fundamental business analysis, and project management. Skills: Microsoft Azure FedRAMP, Puppet, Artifactory, Django, Riverbed Steelscript, Riverbed SteelCentral NetShark, Vagrant, Chocolatey, MuleSoft, PostgreSQL, JavaScript, BASH Scripting, PowerShell, RHEL, DevOps, Docker, Visual Studio, BeEf, Bucket Finder, TLS-Scan, CeWL, JQ, Masscan, Metasploit/Meterpreter, Zenmap, Nmap, Mimikatz, SpiderFoot, Unshadow + John, Volatility, and personal new favorite: SRUM-Dump. I specialize in providing IT security expertise and guidance in support of security assessments and continuous monitoring for government (FISMA & NIST) and commercial clients. I am comfortable in heterogenous environments with tens of thousands of hosts.

,