GitLab has addressed a critical severity vulnerability that could allow remote attackers to take over user accounts using hardcoded passwords.
The bug (discovered internally and tracked as CVE-2022-1162) affects both GitLab Community Edition (CE) and Enterprise Edition (EE).
and Enterprise Edition (EE).
Beastmode botnet boosts DDoS power with new router exploits
This flaw results from static passwords accidentally set during OmniAuth-based registration in GitLab CE/EE.
“A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts,” the GitLab team explained in a security advisory published on Thursday.
GitLab urged users to immediately upgrade all GitLab installations to the latest versions (14.9.2, 14.8.5, or 14.7.7) to block potential attacks.
“We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible,” they said.
A code commit submitted two days shows that GitLab deleted the ‘lib/gitlab/password.rb’ file, which was used to assign a weak hardcoded password to the ‘TEST_DEFAULT’ constant.
GitLab also added that it reset the passwords of a limited number of GitLab.com users as part of the CVE-2022-1162 mitigation effort.
It also found no evidence that any accounts have been compromised by attackers using this hardcode password security flaw.
“We executed a reset of GitLab.com passwords for a selected set of users as of 15:38 UTC,” the GitLab team said.
“Our investigation shows no indication that users or accounts have been compromised but we’re taking precautionary measures for our users’ security.”
When asked to share the number of Gitlab.com users who had their passwords reset, a GitLab spokesperson shared the info already available in the advisory telling BleepingComputer that they only did it for “a selected set of users.”
Photos Source Beker
Discussion about this post