Incorrect Authorization in GitLab

Vulnerability

The vulnerability resides in GitLab EE's direct transfer group import functionality. When importing a group, CI pipeline data is transferred without proper validation of user associations, allowing an attacker to impersonate other users in the pipeline context. Affected versions are 13.12 through 16.2.8, 16.3.0 through 16.3.5, and 16.4.0 through 16.4.1. [1]

Exploitation

An attacker needs the ability to perform a direct transfer group import, which typically requires at least the Maintainer role on the source group. The attacker can craft a malicious export that includes pipeline data with forged user associations. Upon import, the pipeline jobs will appear to be run by the impersonated user. [1]

Impact

Successful exploitation allows the attacker to impersonate any user in CI pipelines, potentially leading to unauthorized actions, privilege escalation, or misleading audit trails. The attacker gains the ability to execute pipelines under another user's identity. [1]

Mitigation

Fixed in GitLab EE versions 16.2.8, 16.3.5, and 16.4.1. Users should upgrade to these versions or later. No workaround is mentioned in the available references. [1]