New Security Vulnerability Affects Thousands of GitLab Instances

Researchers have disclosed details of a now-patched security
vulnerability in GitLab, an open-source DevOps software, that could
potentially allow a remote, unauthenticated attacker to recover
user-related information.

Tracked as CVE-2021-4191 (CVSS score: 5.3), the medium-severity
flaw affects all versions of GitLab Community Edition and
Enterprise Edition starting from 13.0 and all versions starting
from 14.4 and prior to 14.8.

Credited with discovering and reporting the flaw is Jake Baines,
a senior security researcher at Rapid7. Following responsible
disclosure on November 18, 2021, patches were released^[1]
as part of GitLab critical security releases 14.8.2, 14.7.4, and
14.6.5 shipped on February 25, 2022.

“The vulnerability is the result of a missing authentication
check when executing certain GitLab GraphQL API queries,” Baines
said^[2]
in a report published Thursday. “A remote, unauthenticated attacker
can use this vulnerability to collect registered GitLab usernames,
names, and email addresses.”

Successful exploitation of the API information leak could permit
malicious actors to enumerate and compile lists of legitimate
usernames belonging to a target that can then be utilized as a
stepping stone to conduct brute-force attacks, including password guessing^[3], password spraying^[4], and credential stuffing^[5].

“The information leak also potentially allows an attacker to
create a new username wordlist based on GitLab installations — not
just from gitlab.com but also from the other 50,000 GitLab
instances that can be reached from the internet,” Baines said.

Besides CVE-2021-4191, the patch also addresses six other
security flaws, one of which is a critical issue (CVE-2022-0735,
CVSS score: 9.6) that enables an unauthorized attacker to siphon
the runner registration tokens^[6] used to authenticate and
authorize CI/CD jobs hosted on GitLab instances.