CVE-2022-2251 Command injection in GitLab Runner
Attackers can execute arbitrary commands in GitLab Runner by crafting malicious branch names, requiring another user to trigger the pipeline.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-2251?
CVE-2022-2251 is a medium-severity command injection vulnerability in GitLab Runner, published on 17 Jan 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Improper sanitization of branch names in GitLab Runner affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user who creates a branch with a specially crafted name and gets another user to trigger a pipeline to execute commands in the runner as that other user.
Weakness: CWE-78
Which versions are affected by CVE-2022-2251?
1 open source package ship an affected version, including gitlab-runner. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gitlab-runner Bitnami | All versions | 15.3.5, 15.4.4, 15.5.2 |
Products include Gitlab Runner.
How do I fix CVE-2022-2251?
Upgrade gitlab-runner to a fixed version for your release line: 15.3.5, 15.4.4 or 15.5.2.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-2251 being exploited?
There is no known exploitation of CVE-2022-2251 in the wild and no public exploit code.
Other vulnerabilities in GitLab Runner
Sources
Also known as BIT-gitlab-runner-2022-2251, GHSA-cxfq-cc8j-j2pp, UBUNTU-CVE-2022-2251.