Throttling is not enabled in SCM

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_15
Category	System Configuration
Severity	LOW

Impact

Throttling is a technique used to limit the number of requests done by a user in a certain period. GitLab offers an inherent throttling mechanism in its self-managed instances to limit the number of requests sent to its API. However this setting is not applied on the instance. An attacker with access to GitLab can abuse its API to find sensitive files, to check the accessibility of administrative pages, or to overload the instance resources.

Recommended Solution - Buildtime

GitLab self-managed instances offer three options to limit requests:

• Unauthenticated requests
• Authenticated API requests
• Authenticated web requests

There are two options for setting limits:

Modify settings through the console:

1. In the Admin Area, access Settings.
2. Under Network scroll to User and IP Rate Limits.
3. Configure the three settings (see above) with the organization’s required limits.

   For more information refer to https://docs.gitlab.com/ee/user/admin_area/settings/user_and_ip_rate_limits.html#user-and-ip-rate-limits.

Modify settings through the API:

1. Follow the instructions on the GitLab API documentation: documentation: https://docs.gitlab.com/ee/api/settings.html#change-application-settings
2. Set the throttle_ settings according to environment requirements.

• Bypassing throttling settings: If required, add a custom header to requests via predefined services to bypass throttling settings. Refer to: https://docs.gitlab.com/ee/user/admin_area/settings/user_and_ip_rate_limits.html#use-an-http-header-to-bypass-rate-limiting
• Allow specific users to bypass the rate limiter. Refer to: https://docs.gitlab.com/ee/user/admin_area/settings/user_and_ip_rate_limits.html#allow-specific-users-to-bypass-authenticated-request-rate-limiting
• GitLab allows setting a throttle to dry run mode which logs a message to the auth.log when it hits the limit, while letting the request continue as normal. Refer to: https://docs.gitlab.com/ee/user/admin_area/settings/user_and_ip_rate_limits.html#try-out-throttling-settings-before-enforcing-them