Cloudanix VulnDB

CVE-2023-6489

Medium · 4.3

CVSS

4.3

EPSS

0.6%

Published

Apr 12, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in GitLab's chat feature lets someone overload the system so it slows down or becomes unavailable for normal work.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability permits an authenticated user to trigger excessive resource consumption on the GitLab instance through the chat integration feature, resulting in degraded service availability.

Why it matters to the business

Organizations running affected GitLab versions may experience prolonged slowdowns or unavailability of the platform, disrupting development workflows and collaboration until resources are restored.

How an attack unfolds

An attacker with a valid GitLab account enables or interacts with the chat integration feature and sends crafted inputs that cause the instance to allocate disproportionate CPU or memory, gradually exhausting capacity and affecting all users.

How to fix it

Upgrade GitLab CE/EE to version 16.8.6 or later, 16.9.4 or later, or 16.10.2 or later. Apply the fix commit 413f2c727d9beff69c9568e2d83f460dee1fdce1 where applicable and verify the chat integration component is updated.

How to confirm the fix worked

Confirm the running GitLab version is at or above the fixed releases listed above; review instance resource metrics before and after the upgrade to verify the chat integration no longer produces anomalous load under test inputs.

Typical attack path

  1. Obtain a valid low-privileged GitLab account
  2. Access or configure the chat integration feature
  3. Transmit repeated or specially formed chat messages or payloads
  4. Observe progressive resource exhaustion on the target instance

How to detect it

Review GitLab application and audit logs for unusual spikes in chat integration activity or resource usage patterns from individual accounts; correlate with web server access logs showing repeated chat-related requests during performance degradation events.

What your security team should do

  • Prioritize upgrade of all GitLab instances to the fixed versions within the next maintenance window
  • Temporarily restrict or disable chat integration for non-essential users if immediate patching is not feasible
  • Monitor GitLab release notes for any follow-on patches related to resource-handling components

The record

A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature.

Affected packages

Ecosystem Package Introduced Fixed
Bitnami gitlab 16.7.7 16.8.6
Ubuntu:16.04:LTS gitlab 0 No fix
Ubuntu:Pro:16.04:LTS gitlab 0 No fix

Related vulnerabilities