Gitlab patches bug that could expose a CI/CD pipeline to supply chain attack

GitLab has addressed 17 vulnerabilities, including a critical flaw (CVE-2024-6678) with a CVSS score of 9.9 that could allow attackers to trigger a CI/CD pipeline as arbitrary users. This could lead to privileged escalation, data exfiltration, and potential software supply chain compromises. The vulnerability affects all versions of GitLab CE/EE from 8.14 to prior versions of 17.1.7, 17.2 to prior versions of 17.2.5, and 17.3 to prior versions of 17.3.2. Although this flaw has not yet been exploited in the wild, it shares similarities with tactics used by advanced persistent threat (APT) groups, raising concerns about long-term access and data manipulation. Experts warn that if exploited, attackers could access source code, introduce malicious code, and compromise underlying operating systems. The risk is heightened if accounts are shared between GitLab instances, potentially allowing attackers from one organization to access another. Security teams are advised to not only patch their systems but also ensure that their partners are secure to mitigate the risk of supply chain infections.

- GitLab patched 17 vulnerabilities, including a critical flaw with a CVSS score of 9.9.

- The vulnerability could allow attackers to trigger CI/CD pipelines, leading to data exfiltration and software supply chain compromises.

- It affects multiple versions of GitLab CE/EE, emphasizing the need for timely updates.

- Experts highlight the risk of shared accounts between organizations, increasing vulnerability to attacks.

- Security teams must ensure their partners are also patched to prevent supply chain infections.