Comment by miduil

3 hours ago

At least second regex related CVE in GitLab in the past few weeks. Awful to see that the endpoint is reachable unauthenticated, but I'm glad that they provide guidance in how to check the logs for attempts of exploitation

2 comments

miduil

dvdkon 3 hours ago

As far as I can tell, it requires forcing GitLab to render a malicious org-mode file. I don't really see a way to do that without authenticating and uploading one. Am I missing something?

merb 2 hours ago
The attack needs no authentication — only one public project that can hold the .org payload.
So probably not vulnerable if no public projects exist - ie self hosted has an needs auth for everything mode.