Ahacker1

An issue exists where an authenticated user can spoof merge request authorship and attribute content to arbitrary existing users on the target instance. This occurs during Direct Transfer imports due to improper reliance on ephemeral cache state, which is a temporary storage area used to hold data for short-term access.

A stored cross-site scripting (XSS) issue exists where an authenticated attacker can inject arbitrary HTML attributes into rendered Markdown. This occurs because the Markdown rendering pipeline rewrites quote characters in previously sanitized HTML without performing a second sanitization pass. By using crafted Markdown and same-origin JavaScript gadgets, an attacker can bypass the Content Security Policy (CSP) and control the page DOM. This could lead to the theft of content visible to the victim, extraction of embedded CSRF tokens, execution of state-changing actions, and data exfiltration. Additionally, the payload may propagate to organizations and repositories where the victim possesses write access.

An issue exists where an authenticated user with project-level permissions can access restricted file contents on the server or cause a denial of service. This occurs due to improper validation of parameters within the Terraform state upload functionality.

A time-of-check time-of-use (TOCTOU) race condition—a scenario where a system checks the state of a resource before using it, but the state changes between the check and the use—allows remote code execution. Exploitation requires an authenticated user with write access to a repository and precise timing of concurrent upload requests.

An incorrect authorization issue allows a user-to-server token scoped to a GitHub App installation to perform write operations on public repositories outside its intended scope. This occurs because the authorization check only verifies if the installation has read permissions on the target repository instead of confirming the token's installation was explicitly granted access. An attacker possessing a victim's user-to-server token could create issues, issue comments, commit comments, and private vulnerability reports on any public repository, appearing as the victim user without indicating app involvement.

A server-side request forgery (SSRF) issue exists where an unauthenticated attacker can send crafted requests to internal services due to insufficient input validation in an upload endpoint. By injecting path traversal content into request parameters, an attacker can bypass the intended request flow and redirect internal API calls, which may lead to the access of internal services and exposure of sensitive credentials. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

An incorrect regular expression allows an attacker to bypass OAuth redirect URI validation. An attacker aware of a first-party OAuth application's registered callback URL can create a malicious authorization link. If a victim clicks this link, the OAuth authorization code is redirected to a domain controlled by the attacker, potentially granting unauthorized access to the victim's account based on the scopes granted to the OAuth application.

An improper authorization issue exists in scoped user-to-server (`ghu `) token authorization. An authenticated attacker can access private repositories outside the intended installation scope, potentially performing write operations. This occurs due to an authorization fallback that treats a revoked or deleted installation as a global installation context, which may be combined with token revocation timing and SSH push attribution to obtain and reuse a victim-scoped token.

An improper authorization issue exists where an authenticated attacker can determine the names of private repositories using their numeric ID. This occurs because the mobile upload policy API endpoint ''/mobile/upload policy'' fails to perform an early authorization check, resulting in validation error messages that disclose the full repository name for repositories the caller is not authorized to access.

An authorization bypass allows an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository. This occurs by manipulating the `owner id` parameter in the request body. While authorization is verified against the repository in the URL, the action is applied to the repository specified in the request body. The impact is limited to assigning existing trusted users as bypass reviewers and does not allow the addition of arbitrary external users.

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 18.8.9, 18.9 through 18.9.5, and 18.10 through 18.10.3 Description A flaw exists in GitLab CE/EE that could allow an authenticated user to access confidential issues assigned to other users through CSV export. This is due to insufficient authorization checks during the export process. Recommendations Update to GitLab CE/EE version 18.8.9 or later. Update to GitLab CE/EE version 18.9.5 or later. Update to GitLab CE/EE version 18.10.3 or later.

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.14.24 through 3.19.3 Description An improper authorization issue was found in GitHub Enterprise Server. A user with read access to a repository and write access to a project could modify issue and pull request metadata through the project. Column value updates were applied without verifying the actor's repository write permissions when adding an item to an existing project. This issue was reported through the GitHub Bug Bounty program. Recommendations Update to GitHub Enterprise Server version 3.14.24. Update to GitHub Enterprise Server version 3.15.19. Update to GitHub Enterprise Server version 3.16.15. Update to GitHub Enterprise Server version 3.17.12. Update to GitHub Enterprise Server version 3.18.6. Update to GitHub Enterprise Server version 3.19.3.

A missing authorization check exists in the repository migration upload endpoint of GitHub Enterprise Server. An attacker with authentication to the instance can upload unauthorized content to another user’s repository migration export by supplying the migration identifier. This allows overwriting or replacing a victim’s migration archive, potentially leading to the download of attacker-controlled repository data during migration restores or automated imports.

An authorization flaw exists in GitHub Enterprise Server that could allow an attacker to merge a pull request into a repository without necessary push permissions. This is due to an authorization bypass in the `enable auto merge` mutation for pull requests. The issue requires the target repository to allow forking and relies on opening a pull request from a fork controlled by the attacker. Successful exploitation is limited to pull requests with a clean status and branches lacking branch protection rules.

GitLab CE/EE is affected by a high-severity issue that allows an attacker with knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses. The issue stems from an unchecked return value weakness in GitLab's authentication services. The vulnerability could enable full account takeover, potentially leading to access, modification, or deletion of sensitive code repositories and cloud secrets. Exploitation could also lead to supply chain attacks. There is no information available regarding the number of affected devices worldwide.

GitLab CE/EE is susceptible to a denial of service condition. An unauthenticated user can trigger this by sending repeated malformed SSH authentication requests.

An authentication bypass vulnerability was found in ruby-saml due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. This allows an attacker to execute a Signature Wrapping attack, which may lead to authentication bypass.

An issue has been discovered in GitLab CE/EE that affects the confidentiality of issues in public projects. It was possible to disclose the title and description of confidential issues via the user interface to unauthorized instance users.

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.14.1 GitHub Enterprise Server versions 3.13.4 and earlier GitHub Enterprise Server versions 3.12.9 and earlier GitHub Enterprise Server versions 3.11.15 and earlier GitHub Enterprise Server versions 3.10.17 and earlier Description: A GitHub App installed in organizations could upgrade some permissions from read to write access without approval from an organization administrator. An attacker would require an account with administrator access to install a malicious GitHub App. This issue was reported via the GitHub Bug Bounty program. Recommendations: For GitHub Enterprise Server versions prior to 3.14.1, update to version 3.14.1 or later. For GitHub Enterprise Server versions prior to 3.13.4, update to version 3.13.4 or later. For GitHub Enterprise Server versions prior to 3.12.9, update to version 3.12.9 or later. For GitHub Enterprise Server versions prior to 3.11.15, update to version 3.11.15 or later. For GitHub Enterprise Server versions prior to 3.10.17, update to version 3.10.17 or later.

The issue is related to an XML signature wrapping vulnerability in GitHub Enterprise Server when using SAML authentication with specific identity providers. This vulnerability allows an attacker with direct network access to GitHub Enterprise Server to forge a SAML response, effectively granting themselves site administrator privileges. The vulnerability can be exploited to gain unauthorized access to the instance without requiring prior authentication.