Gitlab – Static passwords set during OmniAuth-based registration (CVE-2022-1162)

Re:Gitlab – Static passwords set during OmniAuth-based regis... by theptip on Friday April 01, 2022 @02:10PM (#30881414)

Thanks for doing the issue sleuthing. This is an excruciatingly bad look.

You'd have thought with all the code-owner functionality that GL has, they would lock down the `/lib/gitlab/auth/` files to require a security engineer to give additional signoff on top of a normal review. It looks like anyone at Gitlab can approve changes to the auth code (except LDAP): https://gitlab.com/gitlab-org/gitlab/-/blob/master/.gitlab/C... which is terrifying if true.

[ Parent | on HN ]

Re:Gitlab – Static passwords set during OmniAuth-based regis... by mdaniel on Friday April 01, 2022 @02:20PM (#30881552)

> to require a security engineer to give additional signoff on top of a normal review

Like this?

> cc @gitlab-com/gl-security/appsec

https://gitlab.com/gitlab-org/gitlab/-/merge_requests/76318#...

I do so desperately hope it doesn't come across as throwing shade, because hindsight-2020-etc, but I do also think there was some kind of weird process breakdown here because this change somehow slipped past a "4 eyes" and an appsec review phase

[ Parent | on HN ]

Re:Gitlab – Static passwords set during OmniAuth-based regis... by nightpool on Friday April 01, 2022 @03:14PM (#30882168)

This was already required in this case, you can see in the comments that an additional AppSec review was done and the appsec team signed off on the MR above and beyond the normal code review process.

[ Parent | on HN ]

Re:Gitlab – Static passwords set during OmniAuth-based regis... by bloomburger on Saturday April 02, 2022 @12:55AM (#30885921)

And two of those appsec reviewers are now out of office for the next two weeks…

[ Parent | on HN ]

Re:Gitlab – Static passwords set during OmniAuth-based regis... by orojackson on Saturday April 02, 2022 @03:17AM (#30886432)

Heh, was this you [1]? Pretty much asking the same good questions you brought up in a different post.

Additionally, I see that the Senior Director of Engineering, Tim Zallmann, has left a bunch of GitLab project repos about 14 hours ago as of this writing. He was one of the folks who tried pinging [3] Mr. Coutable (he's one of the reviewers that's currently OOO). The ping is likely regarding the discovery of the security vulnerability.

[1] https://gitlab.com/gitlab-org/gitlab/-/merge_requests/76318#...

[2] https://gitlab.com/users/timzallmann/activity

[3] https://gitlab.com/gitlab-org/gitlab/-/merge_requests/76318#...

[ Parent | on HN ]