GitLab
A platform for Git repositories and build pipelines, often self-hosted.
Where It Sits
The small stack marks its layer. Beside it, each related technology links to its own page.
- AppGitLab
- Framework
- Web Server
- Runtime
- Containers
- OS
- Hypervisor
- Firmware
- Hardware
- Data
About
GitLab hosts Git repositories and runs build and deployment pipelines. It is a large Ruby on Rails application, run by Puma behind its own nginx, that keeps its data in PostgreSQL and Redis. Teams often self-host it, which means they own every layer beneath it.
How to Spot It
These are signs that a system runs GitLab, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.
- Path
/users/sign_in- Cookie
_gitlab_session- Page title
Sign in · GitLab
If It Has a Flaw
GitLab holds source code, deployment keys and pipeline secrets, so a flaw in it can reach far beyond the one server into everything those secrets unlock.
A flaw exposes the data it keeps.
- Data
PostgreSQL
Redis
Well-Known Flaws
Each flaw has a CVE id, the unique number a publicly known vulnerability is given so that every advisory names the same flaw. The id links to the advisory, and the card says what the flaw let an attacker do and how far it reached because of where GitLab sits.
CVE-2023-7028 (opens in a new tab)2024
Password Reset Account Takeover
Password reset emails could be sent to an attacker-controlled address.
Reach It exposed accounts that had no two-factor sign-in, with their code and secrets.
Stacks and Code
Its code arrives from the sources listed, and each source's page says how bad code could get in through it.
- Its Code Comes From
RubyGemsVendor Updates