CVE-2023-4008: 
GitLab vulnerability analysis and mitigation

CVE-2023-4008 is a security vulnerability discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, and all versions starting from 16.2 before 16.2.2. The vulnerability was discovered internally by GitLab team member kassio and disclosed on August 1, 2023 (GitLab Security Release).

The vulnerability allowed attackers to take over GitLab Pages with unique domain URLs if the random string added was known. The issue has been assigned a CVSS v3.1 base score of 5.3 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) by GitLab Inc., while the NVD assigned it a score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (NVD).

The vulnerability could allow attackers to hijack traffic intended for legitimate GitLab Pages by exploiting the way unique domain URLs were formatted. This particularly affected public projects, which had a higher risk of being attacked (GitLab Issue).

The vulnerability has been patched in GitLab versions 16.0.8, 16.1.3, and 16.2.2. The fix involved changing the separator used in unique URLs from '-' to '*', as asterisks are valid URL characters but invalid in project/group name/paths, preventing malicious users from creating projects that could match Pages Unique Domain URLs (GitLab Security Release).