GitLab Community/Enterprise up to 11.6.9/11.7.5/11.8.0 Permission path traversal

Summaryinfo

A vulnerability was found in GitLab Community and Enterprise up to 11.6.9/11.7.5/11.8.0. It has been declared as critical. Impacted is an unknown function of the component Permission. Executing a manipulation can lead to path traversal. This vulnerability appears as CVE-2019-9222. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in GitLab Community and Enterprise up to 11.6.9/11.7.5/11.8.0 (Bug Tracking Software). It has been declared as critical. This vulnerability affects some unknown processing of the component Permission. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions.

The bug was discovered 03/04/2019. The weakness was presented 04/17/2019 (Website). The advisory is shared for download at about.gitlab.com. This vulnerability was named CVE-2019-9222 since 02/28/2019. The exploitation appears to be easy. The attack can be initiated remotely. Required for exploitation is a single authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1006.

The vulnerability was handled as a non-public zero-day exploit for at least 44 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371751 (GitLab Multiple Security Vulnerability).

Upgrading to version 11.6.10, 11.7.6 or 11.8.1 eliminates this vulnerability.

See VDB-133457, VDB-133458, VDB-133459 and VDB-133460 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Bug Tracking Software

Vendor

• GitLab

Name

• Community
• Enterprise

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.5
• 11.6
• 11.6.0
• 11.6.1
• 11.6.2
• 11.6.3
• 11.6.4
• 11.6.5
• 11.6.6
• 11.6.7
• 11.6.8
• 11.6.9
• 11.7
• 11.7.0
• 11.7.1
• 11.7.2
• 11.7.3
• 11.7.4
• 11.7.5
• 11.8.0

License

• open-source

Website

• Vendor: https://gitlab.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion