CVE-2023-2478
Description
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 before 15.10.6, all versions starting from 15.11 before 15.11.2. Under certain conditions, a malicious unauthorized GitLab user may use a GraphQL endpoint to attach a malicious runner to any project.
Summary dbcve.org
This is an authorization bypass vulnerability in GitLab's GraphQL API where an unauthorized or malicious user can register and attach a runner to any project by exploiting the GraphQL endpoint. Since CI/CD runners can execute arbitrary commands and access sensitive environment variables and secrets, a malicious runner attached to projects could expose credentials, steal code, or compromise the build pipeline.
Mitigation
Upgrade GitLab to version 15.9.7, 15.10.6, 15.11.2 or later. Additionally, audit existing runners to identify and remove any unauthorized or suspicious runners attached to projects.