GitLab Security Essentials - Hands-On Lab: Addressing Vulnerabilities

This Hands-On Guide walks you through how to triage and respond vulnerabilities in your application

Estimated time to complete: 15 minutes

In the last lab, you introduced the SAST and Secret Detection scanners into your project. In this lab, we will explore methods to triage and resolve vulnerabilities.

Task A. Vulnerability Triage Process

Navigate to your Security Labs project.
In the left sidebar, select Secure > Vulnerability Report.

To start your triage process, it is recommended to sort your vulnerabilities by severity, focusing on vulnerabilities that have not yet been triaged.

In the security report, select Severity to change the sort order. Ensure that the arrow is pointing down so that severity is sorted from highest to lowest.
Select the top severity vulnerability, GitLab Personal Access Token.
Review the vulnerability. You will see that the finding is valid, containing a GitLab API token.
In the top right corner, set Status to Confirmed.
Select Create issue.
You will see that the issue automatically populates the vulnerability title and details. Review the issue details, then select Create issue.
Return to Secure > Vulnerability Report.
Select the next vulnerability: Improper neutralization of special elements used in a SQL command.
Select the Code flow tab.
Review the code flow to see how the vulnerability occurs. Set the Status to Confirmed.
Select the Details tab.
Select Create issue.
Review the issue and select Create issue.

At this point, we’ve created two issues to address as security issues in our application. Let’s review the process for fixing these vulnerabilities.

Task B. Fixing Vulnerabilities

Navigate to Plan > Issues.
Select the issue titled GitLab Personal Access Token.
Select the code location: main.py:5.
Select Edit > Open in Web IDE.
Select the main.py file.
Delete the line of code:
```
app.config['SECRET_KEY'] = 'glpat-Li5iWgSuUmDXNShPsozE'
```
In a real scenario, you will also need to rotate this key. Deleting the line of code only removes it from the current code, but the secret may still be contained in the Git history and should be considered compromised.
In the left sidebar, select the Source Control icon.
Click Create a new branch and commit.
Press Enter to take the default branch name.
Select Create MR in the bottom right of the screen.
Select Create merge request.
Wait for the pipeline in the merge request to complete. Refresh the page once completed to view the Security Report.
Review the findings. You should no longer see the GitLab Personal Token issue in the security list.
Select Merge to merge the security updates.
Try out solving the SQL injection vulnerability on your own!

Lab Guide Complete

You have completed this lab exercise. You can view the other lab guides for this course.

Suggestions?

If you’d like to suggest changes to the GitLab Security Essentials Hands-On Guide, please submit them via merge request.

Last modified May 1, 2025: Updating ILT Labs for Security Essentials (4959f353)

View page source - Edit this page - please contribute.