GitLab Security Essentials - Hands-On Lab: Addressing Vulnerabilities

This Hands-On Guide walks you through how to triage and respond vulnerabilities in your application

Estimated time to complete: 15 minutes

In the last lab, you introduced the SAST and Secret Detection scanners into your project. In this lab, we will explore methods to triage and resolve vulnerabilities.

Task A. Vulnerability Triage Process

Navigate to your Security Labs project.
In the left sidebar, select Secure > Vulnerability Report. To start your triage process, it is recommended to sort your vulnerabilities by severity, focusing on vulnerabilities that have not yet been triaged. This is the default setting.
In the security report, select Severity to change the sort order. Ensure that the arrow is pointing down so that severity is sorted from highest to lowest.
Select the severity vulnerability GitLab Personal Access Token. It should be at the top or close to the top.
Review the vulnerability. You will see that the finding is valid, as the main.py file contains a GitLab API token.
In the top right corner, click Edit Vulnerability, and then choose Change status. Set the status to Confirmed, and click Change status.
Scroll down to the bottom of the page, and select Create issue.
You will see that the issue automatically populates the vulnerability title and details. Review the issue details, then select Create issue.
Return to Secure > Vulnerability Report.
Select the first instance of the vulnerability Improper neutralization of special elements used in a SQL command (‘SQL Injection’).
Select the Code flow tab.
Review the code flow to see how the vulnerability occurs. In the top right corner, click Edit Vulnerability, and then choose Change status. Set the status to Confirmed, and click Change status.
Select the Details tab.
Scroll down to the bottom of the page, and select Create issue.
Review the issue and select Create issue.

At this point, we’ve created two issues to address as security issues in our application. Let’s review the process for fixing these vulnerabilities.

Task B. Fixing Vulnerabilities

Navigate to Plan > Issues.
Select the issue titled Investigate vulnerability: GitLab personal access token.
Select the code location: main.py:5.
Select Edit > Open in Web IDE.
Select the main.py file.
Delete the line of code:
```
app.config['SECRET_KEY'] = 'glpat-Li5iWgSuUmDXNShPsozE'
```
In a real scenario, you will also need to rotate this key. Deleting the line of code only removes it from the current code, but the secret may still be contained in the Git history and should be considered compromised.
In the left sidebar, select the Source Control icon.
Type an appropriate commit message (e.g. ‘Removed API key), and click Create a new branch and commit.
Press Enter to take the default branch name.
Select Create MR in the bottom right of the screen.
Select Create merge request at the bottom of the page.
Wait for the pipeline in the merge request to complete, and refresh the page. Click on View all pipeline findings.
Review the findings. You should no longer see the GitLab Personal Token issue in the security list.
Return to the MR, and select Merge to merge the security updates.
Try out solving the SQL injection vulnerability on your own!

Lab Guide Complete

You have completed this lab exercise. You can view the other lab guides for this course.

Suggestions?

If you’d like to suggest changes to the GitLab Security Essentials Hands-On Guide, please submit them via merge request.

Last modified May 27, 2025: Security Essentials Lab Fixes (41c2c8ba)

View page source - Edit this page - please contribute.