Description:

CVE-2024-0402 is a critical vulnerability in GitLab CE/EE versions 16.0 to 16.6.6, 16.7 to 16.7.4, and 16.8 to 16.8.1. It allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace. This vulnerability has a CVSS score of 9.9, indicating its severe impact on confidentiality, integrity, and availability. However, the SOCRadar Vulnerability Risk Score (SVRS) of 34 suggests that the vulnerability is not as critical as the CVSS score indicates.

Key Insights:

1. Exploitation: Active exploits for CVE-2024-0402 have been published, making it a high-priority target for attackers.
2. Threat Actors: Threat actors and APT groups are actively exploiting this vulnerability to gain unauthorized access to GitLab servers and compromise sensitive data.
3. CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about CVE-2024-0402, urging organizations to take immediate action to patch their systems.
4. In the Wild: The vulnerability is actively exploited by hackers in the wild, making it a significant threat to organizations using GitLab.

Mitigation Strategies:

1. Update GitLab: Organizations should immediately update their GitLab instances to the latest version (16.6.6, 16.7.4, or 16.8.1) to mitigate the vulnerability.
2. Restrict Access: Implement strict access controls to limit the number of users who can create workspaces and write files to the GitLab server.
3. Enable Two-Factor Authentication: Enforce two-factor authentication for all GitLab users to add an extra layer of security.
4. Monitor for Suspicious Activity: Continuously monitor GitLab logs and activity for any suspicious behavior that may indicate an attack.

Additional Information:

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.