GitLab CI Variable Disclosure Vulnerability

A vulnerability exists in GitLab CE/EE in all versions prior to 17.10.7, 17.11 prior to 17.11.3, and 18.0 prior to 18.0.1. This issue allows an attacker to potentially expose masked or hidden CI variables, which they did not create, in the WebUI. The exploitation involves creating a personal CI variable and then monitoring the HTTP response for the disclosure of other variables.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of CI variables, potentially including sensitive information.

Reproduction

To reproduce this vulnerability, create a new CI variable in the GitLab WebUI. After saving the variable, check the HTTP response for any masked or hidden CI variables that were not authored. This can be done by observing the response in the browser's developer tools.

Remediation

Users are advised to update to GitLab versions 17.10.7, 17.11.3, or 18.0.1.