CVE-2023-5117

What it actually does

The vulnerability allows unauthenticated users to access files uploaded to comments on confidential issues and epics in public projects by directly accessing the file URLs, bypassing authorization checks.

Why it matters to the business

Sensitive files intended to be confidential could be leaked to unauthorized parties, leading to data exposure risks in organizations using GitLab for project management.

How an attack unfolds

An attacker identifies a public project with confidential issues or epics, obtains or guesses the direct URL of an uploaded file from comments, and accesses the file without authentication.

How to fix it

Upgrade GitLab to version 17.6.0 or later, which includes the fix commit a8830741d3c4ad7f6a70eed38ee7af31f298d093.

How to confirm the fix worked

Verify the GitLab instance version is 17.6.0 or higher; attempt to access a file URL from a confidential issue comment without authentication to confirm it is blocked.

Typical attack path

1. Discover public GitLab project with confidential issues/epics
2. Locate or predict direct file URLs from comment uploads
3. Access the file URL directly without authentication

How to detect it

Examine web server access logs for direct requests to file upload paths associated with confidential issues without corresponding authentication events.

What your security team should do

• Upgrade to the fixed version immediately
• Review and audit access to confidential issues and epics
• Monitor for any unauthorized file accesses in logs