{"id":87186,"date":"2026-07-13T12:46:50","date_gmt":"2026-07-13T12:46:50","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2023-5356-gitlab-ce-ee-incorrect-authorization-check-that-enables-unauthorized-slash-command-execution","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2023-5356-gitlab-ce-ee-incorrect-authorization-check-that-enables-unauthorized-slash-command-execution\/","title":{"rendered":"CVE-2023-5356: GitLab CE\/EE Incorrect Authorization Check that Enables Unauthorized Slash Command Execution<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

CVE-2023-5356 is a severe vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE), which may lead to unauthorized command execution and potential system compromise. It arises from improper authorization checks in multiple versions of GitLab CE\/EE, allowing users to exploit slack\/mattermost integrations and execute slash commands as different users. This vulnerability is critical as it could lead to data leakage or complete system compromise if exploited.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2023-5356
\nSeverity: High (CVSS: 7.3)
\nAttack Vector: Network
\nPrivileges Required: Low
\nUser Interaction: Required
\nImpact: Unauthorized command execution as a different user leading to potential system compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

GitLab CE\/EE | 8.13 to 16.5.5
\nGitLab CE\/EE | 16.6 to 16.6.3
\nGitLab CE\/EE | 16.7 to 16.7.1<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit works by abusing the slack\/mattermost integrations in GitLab, enabling a user to execute slash commands as another user. This is due to incorrect authorization checks within these versions of GitLab, which fail to properly validate the user executing the commands. Essentially, an attacker could manipulate the communication between GitLab and the slack\/mattermost platforms to execute potentially malicious commands.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here’s a conceptual example of how this vulnerability might be exploited using an HTTP request:<\/p>\n

POST \/api\/v4\/projects\/:id\/services\/slack\/slash_commands HTTP\/1.1\nHost: GitLab.example.com\nContent-Type: application\/json\n{\n\"token\": \"slack_token\",\n\"user_id\": \"malicious_user\",\n\"command\": \"\/execute\",\n\"text\": \"malicious_command\"\n}<\/code><\/pre>\n
In this example, a malicious user sends a POST request to the slack slash commands service on the GitLab server, executing a potentially harmful command under the guise of another user.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview CVE-2023-5356 is a severe vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE), which may lead to unauthorized command execution and potential system compromise. It arises from improper authorization checks in multiple versions of GitLab CE\/EE, allowing users to exploit slack\/mattermost integrations and execute slash commands as different users. This vulnerability is critical […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-87186","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t