This week GitLab published another Critical Security Release. Once again, a Remote Command Execution via GitHub import was part of the update. The respective CVE-2022-2992 has a CVSSv3 score of 9.9. The previous Critical Security Release from 2022-08-22 also listed an astonishingly similar vulnerability, CVE-2022-2884. The only difference seems to be the reporter. Import is a popular door into GitLab: in July STAR Labs walked through a post-auth RCE in project import.
