CVE-2022-51026: Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login
Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLABSELFHOST endpoint. Attackers can set instanceUrl to a server they control that returns an active user with a chosen email. Bytebase then issues session tokens for that principal, letting attackers impersonate existing users including the Owner or create new members.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Bytebaseto a version that resolves this vulnerability.Fixed in 1.0.1
Event History
Frequently Asked Questions
Which deployments are affected?
Bytebase versions from 0.12.0 before 1.0.1 are affected. The vulnerable login path is POST /api/auth/login/GITLAB_SELF_HOST.
What does an attacker need to exploit this issue?
An attacker does not need credentials or prior access. They can supply a GitLab instanceUrl pointing to a server they control and make it report an active user with an email address they choose.
What level of access could an attacker obtain?
The attacker can receive session tokens for an existing Bytebase user matching the chosen email address, including an Owner. They can also create new members.