CVE-2020-5415: GitLab auth vulnerability in Concourse
Summary
CVE-2020-5415: GitLab auth uses full name instead of username as user ID, allowing impersonation. Affects github.com/concourse/concourse across 4 version ranges.
>= 0.0.0, < 1.6.1-0.20200730151558-b00d1c8d8576
< 0.0.0-20200730151558-b00d1c8d8576
>= 1.6.1, < 6.3.1
>= 6.4.0, < 6.4.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- concourse · Bitnami
The same CVE-2020-5415 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concourse is an open-source continuous integration and delivery (CI/CD) platform that helps automate software development processes. It allows teams to define and execute pipelines for building, testing, and deploying applications. GitLab is a web-based DevOps lifecycle tool that provides version control, issue tracking, and CI/CD capabilities. Concourse integrates with GitLab for authentication purposes, allowing users to log in using their GitLab credentials. However, a vulnerability in the GitLab auth connector of Concourse allows for identity spoofing, potentially leading to unauthorized access and impersonation.
Vulnerability Detail
The vulnerability arises from the use of the full name instead of the username as the user ID in the GitLab auth connector of Concourse. This allows an attacker to configure a GitLab account with the same full name as another GitLab user who has access to a Concourse team. By listing the attacker's full name under users in the team configuration or providing it to the --gitlab-user flag, the attacker can impersonate the legitimate user and gain access to the team. This vulnerability affects Concourse installations that use the GitLab auth connector. Installations that do not use this connector are not affected. The impact of this vulnerability includes identity spoofing, unauthorized access to Concourse teams, and potential data breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.0.0-20200730151558-b00d1c8d85760.0.0-20200730151558-b00d1c8d8576go get github.com/concourse/concourse@v0.0.0-20200730151558-b00d1c8d8576 -
>= 0.0.0, < 1.6.1-0.20200730151558-b00d1c8d85761.6.1-0.20200730151558-b00d1c8d8576go get github.com/concourse/concourse@v1.6.1-0.20200730151558-b00d1c8d8576 -
>= 1.6.1, < 6.3.16.3.1go get github.com/concourse/concourse@v6.3.1 -
>= 6.4.0, < 6.4.16.4.1go get github.com/concourse/concourse@v6.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A workaround for this vulnerability is to use GitLab groups instead of individual GitLab users. By moving GitLab users into groups and configuring the groups in the Concourse team, the vulnerability can be mitigated. GitLab groups do not have this vulnerability, so using groups instead of individual users eliminates the risk of identity spoofing.
Conclusion
The GitLab auth vulnerability in Concourse allows for identity spoofing and unauthorized access to teams. It is crucial to upgrade Concourse to the fixed versions and switch GitLab users to their usernames. Using GitLab groups is a recommended workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/concourse/concourse →
FAQ
Concourse versions 6.3.0 and 6.4.0 are affected. The vulnerability has been fixed in versions 6.3.1 and 6.4.1.
The vulnerability allows for identity spoofing, potentially leading to unauthorized access to Concourse teams and data breaches.
To fix this vulnerability, upgrade Concourse to version 6.3.1 or 6.4.1 and switch GitLab users from their full name to their username.
Yes, using GitLab groups instead of individual users can mitigate the vulnerability.
No, using GitLab groups is the recommended workaround for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/concourse/concourse.
