Security experts recommend that organizations running GitLab implement these updates as soon as possible, especially those using SAML authentication or considering enabling the Direct Transfer feature. The vulnerability can be exploited if an attacker-controlled authenticated user account attempts to transfer a maliciously-crafted project via the Direct Transfer feature, which is currently in beta stage and disabled by default for all self-managed GitLab instances. GitLab has acknowledged the work of security researcher “yvvdwf” who reported this vulnerability through their HackerOne bug bounty program, as well as Robert Mosolgo from ruby-graphql for collaboration on cross-vendor disclosure and remediation efforts. According to GitLab’s security advisory, an attacker with access to a valid signed SAML document from an Identity Provider (IdP) could exploit these vulnerabilities to authenticate as another legitimate user within the environment’s SAML IdP. These include enabling GitLab’s native two-factor authentication for all user accounts, disabling the SAML two-factor bypass option, and requiring administrative approval for automatically created new users by setting gitlab_rails[‘omniauth_block_auto_created_users’] = true in the configuration. The company has urged all self-managed GitLab installations to immediately upgrade to versions 17.9.2, 17.8.5, or 17.7.7 for both Community Edition (CE) and Enterprise Edition (EE) to address these security issues. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. Additionally, GitLab has addressed CVE-2025-27407, a “High” severity vulnerability discovered in the Ruby graphql library. The patch releases include various bug fixes addressing issues such as search timeout problems with special characters, project repository logic, and improvements to development kit components. GitLab Dedicated customers have been advised that they do not need to take immediate action and will be notified once their instances have been patched automatically. She is covering various cyber security incidents happening in the Cyber Space. GitLab is already running the patched versions, meaning cloud users are protected from these vulnerabilities.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 13 Mar 2025 09:00:08 +0000