Cloudanix VulnDB

CVE-2023-6682

Medium · 6.5

CVSS

6.5

EPSS

0.8%

Published

May 14, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in how GitLab handles certain chat messages from Discord can make the entire service slow down or stop responding when someone sends a specially crafted message.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A regex processing flaw in Discord Integrations chat message handling allows crafted input to trigger catastrophic backtracking, consuming excessive CPU and causing denial of service.

Why it matters to the business

GitLab instances become unresponsive or slow under attack, disrupting development workflows, CI/CD pipelines, and collaboration for organizations relying on the platform; low exploit maturity reduces immediate risk but patching remains essential given the 883 days since disclosure.

How an attack unfolds

An authenticated user with access to a Discord integration configures or triggers chat message processing with a malicious payload designed to cause regex backtracking; the server spends unbounded time evaluating the expression, leading to resource exhaustion and potential service outage.

How to fix it

Upgrade GitLab to versions 16.9.7, 16.10.5, or 16.11.2 (or later) which incorporate commit 6878f253b7b50c8e6217ebfd03717b5e5ea960a4; disable unused Discord integrations as a temporary mitigation if upgrade is delayed.

How to confirm the fix worked

Confirm the running GitLab version is at or above the fixed releases; test Discord integration functionality with sample messages after upgrade; monitor for absence of excessive regex evaluation CPU usage under load.

Typical attack path

  1. Identify a GitLab instance with Discord integration enabled
  2. Obtain low-privileged authenticated access
  3. Craft a chat message payload that exploits the regex pattern
  4. Submit the message via the integration endpoint
  5. Observe server CPU spike and service degradation or crash

How to detect it

Inspect application logs and performance metrics for spikes in CPU or long-running regex operations tied to Discord integration endpoints; correlate with authenticated user activity around integration message processing.

What your security team should do

  • Prioritize upgrade to a fixed GitLab release within standard change windows due to the availability of patches for over two years
  • Audit and restrict Discord integration usage to only necessary projects
  • Implement rate limiting or WAF rules on integration endpoints as defense-in-depth
  • Review logs for unusual message processing times post-deployment

The record

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. A problem with the processing logic for Discord Integrations Chat Messages can lead to a regular expression DoS attack on the server.

Affected packages

Ecosystem Package Introduced Fixed
Bitnami gitlab 16.9.0 16.9.7
Ubuntu:16.04:LTS gitlab 0 No fix
Ubuntu:Pro:16.04:LTS gitlab 0 No fix

Related vulnerabilities