Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Gitlab patches bug that could expose a CI/CD pipeline to supply chain attack (scmagazine.com)
9 points by Bender on Sept 15, 2024 | hide | past | favorite | 2 comments


This article is devoid of useful information. Rather than discussing this vulnerability, it spends 90% of its time talking about why supply chain attacks are bad. In addition, the NIST page has nearly zero information and the links are similarly unhelpful:

* The GitLab issue 404s

* The hackerone link is behind a login.

* The third link describes how to leverage a class of vulnerabilities, but isn't specific to what this one is. (It's a broad CWE about spoofing.)

Does anyone have a link that actually talks about what this vulnerability is? Even GitLab's patch notes [0] are useless.

[0]: https://about.gitlab.com/releases/2024/09/11/patch-release-g...


I think the article also has no clue what’s going on .

From what I’m guessing, anonymous users might be able to run the stop environment job, which would be bad. Not sure how that chains into a supply chain attack or any of that fun stuff.

here’s the link for what changed updating to the 17.1.7: https://gitlab.com/gitlab-org/gitlab/-/compare/v17.1.6-ee......

The merge commit with calling out environment stop actions: https://gitlab.com/gitlab-org/gitlab/-/commit/e2ceeac5ffc6a6...

The meat of the change is probably this chunk: https://gitlab.com/gitlab-org/gitlab/-/commit/e2ceeac5ffc6a6...

my take on it is that if gitlab doesn’t know who you are, it looks to the last runner of the job (or maybe the creator) to run stop environment. The fix seems to use the current user to attempt the stop environment which seems simple enough.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: