N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-5r3p-6rj5-7937

GHSA-5r3p-6rj5-7937: Bytebase vulnerable to Improper Authentication

Impact

GitLab login allows login by any user.
JWT auth token can be derived as long as the server isn't rebooted.
Developers can assign issues to non-admin/DBA users.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-5r3p-6rj5-7937

GHSA-5r3p-6rj5-7937:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/bytebase/bytebase	go	<= 1.0.0	1.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security advisory and the associated commit a578ed58e478ba5c2dadf8d538ec5c3d39c28461 reveals an improper authentication vulnerability in Bytebase's GitLab login functionality. The root cause was that the authentication endpoint (/auth/gitlab) trusted client-provided parameters for the OAuth flow, including the ApplicationID, Secret, and InstanceURL.

The patch modifies the server/auth.go file to change this behavior. Instead of receiving the sensitive OAuth configuration from the client, the API now only requires a VCS provider ID. The server-side handler then uses this ID to look up the correct configuration from its own database (s.VCSService.FindVCS). This ensures that the authentication process always uses the server's trusted and pre-configured VCS settings.

The vulnerable function is the anonymous Go function that serves as the handler for the POST /auth/gitlab route, which is defined inside the Server.registerAuthRoutes method. During runtime, a profiler would identify this function in the call stack, likely with a name like Server.registerAuthRoutes.func1, when a user attempts to log in via GitLab. The exploitation of this vulnerability would involve sending a crafted request to this endpoint with malicious OAuth parameters.

Vulnerable functions

Server.registerAuthRoutes.func1

server/auth.go

The vulnerability lies in an anonymous function within `Server.registerAuthRoutes` that handles the `POST /auth/gitlab` endpoint. This function previously accepted GitLab OAuth configuration details (Application ID, Secret, and Instance URL) directly from the client. An attacker could provide malicious configuration details in the login request, causing the server to authenticate against an attacker-controlled GitLab instance. This allowed the attacker to bypass authentication and impersonate any user, as the server trusted the client-provided parameters instead of using its own securely stored VCS configuration.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.