GitLab fixes Critical RCE
Share this:
GitLab has fixed a RCE vulnerability tracked as CVE-2022-2884 affecting the Community and the Enterprise Edition of its DevOps platform, and has urged admins to upgrade their GitLab instances immediately
The vulnerability was identified through the company’s bug bounty program and there is no mention of it being actively exploited in the wild.
CVE-2022-2884 is a critical severity issue that may allow an authenticated user to achieve remote code execution via the Import from GitHub API endpoint, the company explained.
It affects all GitLab CE/EE versions:
- Starting from 11.3.4 before 15.1.5
- Starting from 15.2 before 15.2.3
- Starting from 15.3 before 15.3.1
Since attackers have been known to target unpatched GitLab servers, the company “strongly recommends” that all installations running a vulnerable version are upgraded to the latest version as soon as possible.
If upgrading is not possible at the moment, there is a stopgap measure that can be implemented: admins can disable GitHub import on their GitLab installation (Menu -> Admin -> Settings -> General -> Visibility and access controls -> Import sources -> disable the “GitHub” option -> Save changes). This action will mitigate the issue, but also prevent users from importing projects or repositories from GitHub.
