Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 1.0.1
- Public exploit
- None on Exploit-DB
Summary
Bytebase, a database DevOps platform, is affected in versions before 1.0.1 when GitLab self-hosted login is used. An unauthenticated attacker could exploit the flaw to log in as any user, including the owner, and gain full control over the platform and its managed databases.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST endpoint. Attackers can set instanceUrl to a server they control that returns an active user with a chosen email. Bytebase then issues session tokens for that principal, letting attackers impersonate existing users including the Owner or create new members.
Affected versions
- bytebase bytebase
From 0.12.0 · fixed in 1.0.1
- github.com/bytebase/bytebaseGo
fixed in 1.0.1