https://www.bleepingcomputer.com/news/security/critical-gitlab-vulnerability-lets-attackers-take-over-accounts/ BleepingComputer.com logo * * * [ ] [Login] [Sign up] * * * [ ] [Login] [Sign up] * News + Featured + Latest + Critical GitLab vulnerability lets attackers take over accounts Critical GitLab vulnerability lets attackers take over accounts + Spring patches leaked Spring4Shell zero-day RCE vulnerability Spring patches leaked Spring4Shell zero-day RCE vulnerability + Russian-linked Android malware records audio, tracks your location Russian-linked Android malware records audio, tracks your location + LockBit victim estimates cost of ransomware attack to be $42 million LockBit victim estimates cost of ransomware attack to be $42 million + Microsoft now lets you enable the Windows App Installer again, here's how Microsoft now lets you enable the Windows App Installer again, here's how + Russian-linked Android malware records audio, tracks your location Russian-linked Android malware records audio, tracks your location + Beastmode botnet boosts DDoS power with new router exploits Beastmode botnet boosts DDoS power with new router exploits + Trend Micro fixes actively exploited remote code execution bug Trend Micro fixes actively exploited remote code execution bug * Downloads + Latest + Most Downloaded + Qualys BrowserCheck Qualys BrowserCheck + STOPDecrypter STOPDecrypter + AuroraDecrypter AuroraDecrypter + FilesLockerDecrypter FilesLockerDecrypter + AdwCleaner AdwCleaner + ComboFix ComboFix + RKill RKill + Junkware Removal Tool Junkware Removal Tool * Virus Removal Guides + Latest + Most Viewed + Ransomware + How to remove the PBlock+ adware browser extension How to remove the PBlock+ adware browser extension + Remove the Toksearches.xyz Search Redirect Remove the Toksearches.xyz Search Redirect + Remove the Smashapps.net Search Redirect Remove the Smashapps.net Search Redirect + Remove the Smashappsearch.com Search Redirect Remove the Smashappsearch.com Search Redirect + Remove Security Tool and SecurityTool (Uninstall Guide) Remove Security Tool and SecurityTool (Uninstall Guide) + How to remove Antivirus 2009 (Uninstall Instructions) How to remove Antivirus 2009 (Uninstall Instructions) + How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo + How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller + Locky Ransomware Information, Help Guide, and FAQ Locky Ransomware Information, Help Guide, and FAQ + CryptoLocker Ransomware Information Guide and FAQ CryptoLocker Ransomware Information Guide and FAQ + CryptorBit and HowDecrypt Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ + CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ * Tutorials + Latest + Popular + How to make the Start menu full screen in Windows 10 How to make the Start menu full screen in Windows 10 + How to install the Microsoft Visual C++ 2015 Runtime How to install the Microsoft Visual C++ 2015 Runtime + How to open an elevated PowerShell Admin prompt in Windows 10 How to open an elevated PowerShell Admin prompt in Windows 10 + How to Translate a Web Page in Google Chrome How to Translate a Web Page in Google Chrome + How to start Windows in Safe Mode How to start Windows in Safe Mode + How to remove a Trojan, Virus, Worm, or other Malware How to remove a Trojan, Virus, Worm, or other Malware + How to show hidden files in Windows 7 How to show hidden files in Windows 7 + How to see hidden files in Windows How to see hidden files in Windows * Deals + Categories + eLearning eLearning + IT Certification Courses IT Certification Courses + Gear & Gadgets Gear + Gadgets + Security Security * Forums * More + Startup Database + Uninstall Database + File Database + Glossary + Chat on Discord + Send us a Tip! + Welcome Guide * Home * News * Security * Critical GitLab vulnerability lets attackers take over accounts * * Critical GitLab vulnerability lets attackers take over accounts By Sergiu Gatlan * April 1, 2022 * 10:52 AM * 0 GitLab Image: Mahadevu Udaya Bhaskar GitLab has addressed a critical severity vulnerability that could allow remote attackers to take over user accounts using hardcoded passwords. The bug (discovered internally and tracked as CVE-2022-1162) affects both GitLab Community Edition (CE) and Enterprise Edition (EE). This flaw results from static passwords accidentally set during OmniAuth-based registration in GitLab CE/EE. "A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts," the GitLab team explained in a security advisory published on Thursday. GitLab urged users to immediately upgrade all GitLab installations to the latest versions (14.9.2, 14.8.5, or 14.7.7) to block potential attacks. "We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible," they said. A code commit submitted two days shows that GitLab deleted the 'lib/ gitlab/password.rb' file, which was used to assign a weak hardcoded password to the 'TEST_DEFAULT' constant. GitLab hardcoded password assignmentGitLab hardcoded password assignment code (BleepingComputer) Passwords reset for some GitLab users GitLab also added that it reset the passwords of a limited number of GitLab.com users as part of the CVE-2022-1162 mitigation effort. It also found no evidence that any accounts have been compromised by attackers using this hardcode password security flaw. "We executed a reset of GitLab.com passwords for a selected set of users as of 15:38 UTC," the GitLab team said. "Our investigation shows no indication that users or accounts have been compromised but we're taking precautionary measures for our users' security." When asked to share the number of Gitlab.com users who had their passwords reset, a GitLab spokesperson shared the info already available in the advisory telling BleepingComputer that they only did it for "a selected set of users." At this time, no malicious activity or compromise has been identified on https://t.co/C4mACZpLWf related to the potential Okta breach. We continue to monitor and investigate, and strongly recommend enabling MFA. You can see our response here: https:// t.co/nlO7QcGq34 -- GitLab (@gitlab) March 22, 2022 Script to identify affected user accounts While GitLab says no user accounts have been breached so far, the company has created a script that self-managed instance admins can use to identify user accounts potentially impacted by CVE-2022-1162. After identifying potentially affected user accounts, admins are advised to reset the users' passwords. Over 100,000 organizations use its DevOps platform, according to GitLab, and the company estimates it has more than 30 million estimated registered users from 66 countries worldwide. Update April 01, 12:08 EDT: Added CVE-2022-1162 script information. Related Articles: Beastmode botnet boosts DDoS power with new router exploits Trend Micro fixes actively exploited remote code execution bug New Spring Java framework zero-day allows remote code execution Spring patches leaked Spring4Shell zero-day RCE vulnerability Calendly actively abused in Microsoft credentials phishing * DevOps * GitLab * Passwords * Vulnerability * * * * * Sergiu Gatlan Sergiu Gatlan is a reporter who covered cybersecurity, technology, Apple, Google, and a few other topics at Softpedia for more than a decade. Email or Twitter DMs for tips. * Previous Article * Next Article Post a Comment Community Rules You need to login in order to post a comment [Login] Not a member yet? Register Now You may also like: [INS::INS] [Bleeping-Computer-FinServ-2022] Popular Stories * Spring New Spring Java framework zero-day allows remote code execution * Apple Apple emergency update fixes zero-days used to hack iPhones, Macs Newsletter Sign Up To receive periodic updates and news from BleepingComputer, please use the form below. [ ] [Submit] Newsletter Sign Up [ ] [Submit] * Follow us: * * * * Main Sections * News * Downloads * Virus Removal Guides * Tutorials * Startup Database * Uninstall Database * File Database * Glossary Community * Forums * Forum Rules * Chat Useful Resources * Welcome Guide * Sitemap Company * About BleepingComputer * Contact Us * Send us a Tip! * Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement Copyright @ 2003 - 2022 Bleeping Computer^(r) LLC - All Rights Reserved Login Username [ ] Password [ ] [*] Remember Me [ ] Sign in anonymously [Login] Sign in with Twitter button Sign in with Twitter --------------------------------------------------------------------- Not a member yet? Register Now Reporter Help us understand the problem. What is going on with this comment? * ( )Spam * ( )Abusive or Harmful * ( )Inappropriate content * ( )Strong language * ( )Other [ ] * [ ] Read our posting guidelinese to learn what content is prohibited. Submitting... SUBMIT