TMA-GITLAB-1.4.3
Ensure the access granted to each installed application is limited to the least privilege needed
Description
Ensure installed application permissions are limited to the lowest privilege level required. Applications are typically automated integrations that can improve the workflow of an organization. They are written by third-party developers, and therefore should be reviewed carefully before use. It is recommended to use the "least privilege" principle, granting applications the lowest level of permissions required. This may prevent harm from a potentially malicious application with unnecessarily high-level permissions leaking data or modifying source code.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Verify that each installed integration and application has the least privilege needed. For each Project and each Group, perform the following: - Navigate to the project or group homepage - In the sidebar, select Settings > Integrations - Next to every integration, select 'Configure' - Review the integration's configuration and verify that it is limited to the least privilege needed For each Group, perform the following: - Navigate to the project or group homepage - In the sidebar, select Settings > Applications o Next to every Application, select Edit o Review the Applications configuration and verify that it is limited to the least privilege needed As an administrator, perform the following: - Navigate to the Admin Area - In the sidebar, select Applications o Next to every Application, select Edit o Review the Applications configuration and verify that it is limited to the least privilege needed - In the sidebar, select Settings > Integrations o Next to every integration, select 'Configure' o Review the integration's configuration and verify that it is limited to the least privilege needed - In the sidebar, select Overview > Users o Select each user's first name o On the users...
How it is fixed
Fix method: Guidance or infrastructure patch
Grant permissions to applications by the "least privilege" principle, meaning the lowest possible permission necessary. For any Integrations identified during the audit as needing modification: - Next to the integration, select Configure. - Edit the permissions or settings so that they grant the least possible privileges. For example, restrict the branches it can access, or the features that are enabled. - (Optionally) Select 'Test settings' - Select 'Save changes'. For any Applications identified during the audit as needing modification: - Next to the application, select 'Edit'. - Edit the permissions or settings so that they grant the least possible privileges. For example, restrict the API scopes it can use. - Select 'Save application'. If any user authorized applications were identified during the audit as having overly permissive scopes, as an administrator perform the following: - Navigate to the Admin Area - In the sidebar, select Overview > Users o Select the user's first name o On the users detail page, select 'Impersonate' o Navigate to their Preferences page o In the sidebar, select Applications o Under 'Authorized applications', re-identify the overly permissive appl...
Properties
- Operating systems
- Any
- Tags
- access-controldevsecopsgitlab
- Reference
- CIS GitLab Benchmark v1.0.1 - 1.4.3 Ensure the access granted to each installed application is limited to the least privilege needed