GitLab CVE-2023-6371: How can I tell if Banzai is enabled on my GitLab instance?

andrew2758 · March 27, 2024, 11:44pm

Problem to solve

According to the latest security announcement, GitLab’s is vulnerable to attack via Banzai Pipelines. How can I tell if this is a feature that’s enabled on my instance, or are all self-managed GitLab deployments affected prior to upgrade to the newest release?

Steps to reproduce

I looked around, and couldn’t find much info about how Banzai Pipelines are integrated with GitLab. I did find the commit that patches the issue, but it’s not clear whether the Banzai feature is applicable to all installations:

I also looked at the features.yml file, which has no references to “Banzai”:

gitlab.com

gitlab-com/www-gitlab-com/blob/master/data/features.yml

# Among other things, this file drives the feature comparison section of the DevOps Tools pages.
features:
  - title : "Restrict access by IP address"
    description: "Restrict access at the group level to incoming traffic adhering to an IP address subnet, keeping your code secure."
    category:
      - system_access
    link_description: "Restrict group access by IP address"
    link: https://docs.gitlab.com/ee/user/group/#restrict-group-access-by-ip-address
    gitlab_core: false
    gitlab_starter: false
    gitlab_premium: true
    gitlab_ultimate: true
    gitlab_com: true
  - title : "Limit access token lifetime"
    description: "Administrators can set a limit for access tokens that is less than the default of 365 days for compliance purposes"
    category:
      - system_access
    link_description: "Limit access token lifetime"
    link: https://docs.gitlab.com/ee/administration/settings/account_and_limit_settings.html#limit-the-lifetime-of-access-tokens
    gitlab_core: false

This file has been truncated. show original

Any help is appreciated. Thanks! : )

Versions

Self-managed
GitLab.com SaaS

Versions

GitLab 16.9.2

dnsmichi · March 28, 2024, 12:32am

I needed to research myself, looking at the development guides and source code search results - Banzai is a library for parsing/processing Markdown files and uses pipelines do so (this is different to CI/CD pipelines).

It is not a feature that you can enable/disable, so I’d recommend upgrading to fix the vulnerability when you are using the wiki.