CISA Warns of Active Exploitation of Severe GitLab Password Reset Vulnerability

CISA Warns of Active Exploitation of Severe GitLab Password Reset Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical flaw impacting GitLab to its Known Exploited Vulnerabilities (KEV) catalog, owing to active exploitation in the wild.

Tracked as CVE-2023-7028 (CVSS score: 10.0), the maximum severity vulnerability could facilitate account takeover by sending password reset emails to an unverified email address.

GitLab, which disclosed details of the shortcoming earlier this January, said it was introduced as part of a code change in version 16.1.0 on May 1, 2023.

“For instance, an attacker gaining access to the CI/CD pipeline configuration could embed malicious code designed to exfiltrate sensitive data, such as Personally Identifiable Information (PII) or authentication tokens, redirecting them to an adversary-controlled server,” cloud security firm Mitiga said in a recent report.

“Similarly, tampering with repository code might involve inserting malware that compromises system integrity or introduces backdoors for unauthorized access. Malicious code or abuse of the pipeline could lead to data theft, code disruption, unauthorized access, and supply chain attacks.”

The flaw has been addressed in GitLab versions 16.5.6, 16.6.4, and 16.7.2, with the patches also backported to versions 16.1.6, 16.2.9, 16.3.7, and 16.4.5.

CISA has yet to provide any other details as to how the vulnerability is being exploited in real-world attacks. In light of active abuse, federal agencies are required to apply the latest fixes by May 22, 2024, to secure their networks.