Hacker News Reader

Comment by miduil | Hacker News Reader

At least second regex related CVE in GitLab in the past few weeks. Awful to see that the endpoint is reachable unauthenticated, but I'm glad that they provide guidance in how to check the logs for attempts of exploitation

View on HN

As far as I can tell, it requires forcing GitLab to render a malicious org-mode file. I don't really see a way to do that without authenticating and uploading one. Am I missing something?

    The attack needs no authentication — only one public project that can hold the .org payload.

So probably not vulnerable if no public projects exist - ie self hosted has an needs auth for everything mode.

"Can hold"? Meaning the attacker needs push access to a public repo?

It’s ai slopped… don’t waste the precious few brain cells we programmers have left trying to understand it.

Reply on news.ycombinator.com