CVE-2023-6688

What it actually does

A flaw in the Google Chat Messages integration processing logic allows crafted input to trigger catastrophic backtracking in a regular expression, resulting in excessive CPU consumption and potential denial of service.

Why it matters to the business

Attackers can cause service disruption, leading to downtime for GitLab users and potential loss of productivity or availability of development tools.

How an attack unfolds

An authenticated attacker sends specially crafted messages through the Google Chat integration that exploit the regex processing, causing the server to hang or consume high resources.

How to fix it

Upgrade GitLab to version 16.11.2 or later, incorporating the fix from commit d210b947e3e51eebcbb24a9152f5c68f7e2b1d58.

How to confirm the fix worked

Confirm the installed GitLab version is at least 16.11.2; monitor resource usage during integration message processing with test inputs.

Typical attack path

1. Authenticate to a GitLab instance with access to integrations
2. Trigger the Google Chat Messages integration using a malicious payload
3. Cause repeated regex evaluation leading to resource exhaustion

How to detect it

Review application and system logs for spikes in CPU or memory tied to integration message handlers; inspect access patterns to chat integration endpoints.

What your security team should do

• Apply the upgrade to the fixed version immediately
• Review and restrict access to chat integrations where possible
• Monitor for anomalous CPU usage in GitLab services handling external integrations