CVE-2017-17716

Vulnerability

GitLab 9.4.x versions before 9.4.2 do not perform SSL certificate verification for LDAP connections. The verify_certificates option mentioned in the 9.4 release announcement was not implemented due to missing code merge. The issue stems from the omniauth-ldap library and the gitlab_omniauth-ldap gem, which rely on ruby-net-ldap – that library does not enable TLS certificate verification by default [1].

Exploitation

An attacker with network access between a GitLab instance and its LDAP server can perform a man-in-the-middle (MITM) attack. By presenting a fraudulent SSL certificate, the attacker can intercept or modify LDAP authentication traffic. No special privileges on GitLab or the LDAP server are required; the attacker only needs to be positioned to intercept the connection [1].

Impact

Successful exploitation allows an attacker to impersonate the LDAP server, potentially capturing credentials or authenticating as arbitrary users. This undermines the confidentiality and integrity of LDAP-based authentication and may lead to unauthorized access to GitLab resources [1].

Mitigation

GitLab 9.4.2, released 2017-12-17, addresses the issue by ensuring LDAP SSL certificate verification is enforced. Upgrading to 9.4.2 or later is recommended. No workaround is available for earlier versions [1].