Re:Gitlab Critical Security Release
by hn_throwaway_99 on Saturday February 26, 2022 @12:01PM
(#30479368)
This is why threat vector analysis is so important, because in your case, there is no additional vector. If someone has MITM'd you, they can just intercept your token before they pass it to Gitlab.
And to your other point, you're right, if your adversary already has a keylogger running on your device you're pretty much screwed in any case.
It enables phishing where you're actually logged in after submitting your credentials. You don't need a MITM from a network perspective.
That said, someone with the level of access required to exploit this vulnerability isn't going to be stopped because GitLab patches it. There are plenty of other things they could do with that kind of access.