GitLab shares GitHub’s vulnerability to hosting malware
42s
2
15:22, 23.04.2024
GitLab proved to be also vulnerable to GitHub’s vulnerability to posting malware with the help of URL addresses connected to Microsoft repositories.
The vulnerability is related to the comment feature, where one can attach links with a unique URL address in the following format: https://www.github.com/{project_user}/{repo_name}/files/{file_id}/{file_name}» .
The links may be generated while creating a commit comment for repositories of popular and reputable projects and then remain active even in the case the comment hasn’t been published.
The users can attach any files creating a download link for them, and cyber attackers discovered that they can use the feature for sharing malware.
The same vulnerability has been detected in GitLab CDN where links have the following format: https://gitlab.com/{project_group_namr}/{repo_name}/uploads/{file_id}/{file_name}.
Was this article helpful to you?
Yes
No
VPS popular offers
sale
-15%
Linux
€ 134.99 /mo
Billed monthly
sale
-15%
Linux
€ 25.25 /mo
Billed monthly
sale
-26.7%
Linux
€ 10 /mo
Billed annually
sale
-15.6%
Linux
€ 5.33 /mo
Billed annually
sale
-14.9%
Linux
€ 7.7 /mo
Billed semiannually
sale
-15%
Windows
€ 21 /mo
Billed semiannually
sale
-22.2%
Linux
€ 33 /mo
Billed annually
sale
-14.9%
Linux
€ 7.1 /mo
Billed semiannually
sale
-24.7%
Linux
€ 31 /mo
Billed annually
sale
-15%
Linux
€ 231 /mo
Billed monthly
