FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

gitlab -- Various security issues

Affected packages
6.6.0 <= gitlab <= 8.17.5
9.0.0 <= gitlab <= 9.0.6
9.1.0 <= gitlab <= 9.1.2


VuXML ID 9704930c-3bb7-11e7-93f7-d43d7e971a1b
Discovery 2017-05-08
Entry 2017-05-18

GitLab reports:

Cross-Site Scripting (XSS) vulnerability in project import file names for gitlab_project import types

Timo Schmid from ERNW reported a persistent Cross-Site Scripting vulnerability in the new project import view for gitlab_project import types. This XSS vulnerability was caused by the use of Hamlit filters inside HAML views without manually escaping HTML. Unlike content outside of a filter, content inside Hamlit filters (:css, :javascript, :preserve, :plain) is not automatically escaped.

Cross-Site Scripting (XSS) vulnerability in git submodule support

Jobert Abma from HackerOne reported a persitent XSS vulnerability in the GitLab repository files view that could be exploited by injecting malicious script into a git submodule.

Cross-Site Scripting (XSS) vulnerability in repository "new branch" view

A GitLab user reported a persistent XSS vulnerability in the repository new branch view that allowed malicious branch names or git references to execute arbitrary Javascript.

Cross-Site Scripting (XSS) vulnerability in mirror errors display

While investigating Timo Schmid's previously reported XSS vulnerability in import filenames another persistent XSS vulnerability was discovered in the GitLab Enterprise Edition's (EE) mirror view. This vulnerability was also caused by the misuse of Hamlit filters.

Potential XSS vulnerability in DropLab

An internal code audit disclosed a vulnerability in DropLab's templating that, while not currently exploitable, could become exploitable depending on how the templates were used in the future.

Tab Nabbing vulnerabilities in mardown link filter, Asciidoc files, and other markup files

edio via HackerOne reported two tab nabbing vulnerabilities. The first tab nabbing vulnerability was caused by improper hostname filtering when identifying user-supplied external links. GitLab did not properly filter usernames from the URL. An attacker could construct a specially crafted link including a username to bypass GitLab's external link filter. This allowed an attacker to post links in Markdown that did not include the appropriate "noreferrer noopener" options, allowing tab nabbing attacks.

The second vulnerability was in the AsciiDoctor markup library. AsciiDoctor was not properly including the "noreferrer noopener" options with external links. An internal investigation discovered other markup libraries that were also vulnerable.

Unauthorized disclosure of wiki pages in search

M. Hasbini reported a flaw in the project search feature that allowed authenticated users to disclose the contents of private wiki pages inside public projects.

External users can view internal snippets

Christian Kühn discovered a vulnerability in GitLab snippets that allowed an external user to view the contents of internal snippets.

Subgroup visibility for private subgroups under a public parent group

Matt Harrison discovered a vulnerability with subgroups that allowed private subgroup names to be disclosed when they belong to a parent group that is public.