Direct Request ('Forced Browsing') in GitLab

Vulnerability

The vulnerability exists in GitLab EE versions 16.4 before 16.7.6, 16.8 before 16.8.3, and 16.9 before 16.9.1. Users assigned the Guest role are able to change the Custom dashboard projects settings for groups and projects, contrary to the documented permissions that restrict such changes to higher roles [1].

Exploitation

An attacker with a Guest role in a victim's group or project can navigate to the analytics settings page by appending /-/settings/analytics to the project URL. They can then select a project in the combobox and save changes, effectively modifying the Custom dashboard projects setting without proper authorization [1].

Impact

Successful exploitation allows a Guest user to alter the analytics dashboard configuration for the victim's project or group. This could lead to unauthorized changes in which projects are displayed in dashboards, potentially affecting visibility of sensitive data or causing confusion, though the direct CIA impact is limited to integrity of dashboard settings [1].

Mitigation

GitLab has released fixed versions: 16.7.6, 16.8.3, and 16.9.1. Users should upgrade to these versions or later. No workaround is documented; upgrading is the recommended mitigation [1].