Cloudanix VulnDB

CVE-2024-10240

Medium · 5.3

CVSS

5.3

EPSS

0.6%

Published

Nov 26, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in GitLab lets outsiders see limited details about private project updates without logging in, which could reveal sensitive work information.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

An unauthenticated user can retrieve limited merge request metadata from private projects via a specific access path that bypasses authorization checks in affected GitLab EE versions.

Why it matters to the business

Organizations using affected GitLab versions risk unintended exposure of internal project details, potentially aiding competitors or attackers in reconnaissance without authentication.

How an attack unfolds

An attacker identifies a private project merge request URL or identifier and issues crafted unauthenticated requests that trigger the flawed authorization logic, resulting in partial information disclosure before the patched versions enforce proper checks.

How to fix it

Upgrade GitLab EE to 17.3.7, 17.4.4, or 17.5.2 or later depending on the installed branch; apply the corresponding security patches immediately given the public disclosure.

How to confirm the fix worked

Verify the running GitLab version matches or exceeds the fixed releases, review access control test cases for merge requests in private projects, and confirm that unauthenticated requests now return authorization errors.

Typical attack path

  1. Discover or guess a merge request identifier in a private GitLab project
  2. Send unauthenticated HTTP requests to the merge request endpoint or related API
  3. Receive partial metadata response that should have been restricted
  4. Use disclosed details for further targeting or social engineering

How to detect it

Review web server and GitLab application logs for unauthenticated requests to merge request endpoints that return 200 responses instead of 403; correlate with project visibility settings and look for patterns from unknown source IPs.

What your security team should do

  • Prioritize upgrade to fixed GitLab versions within the next maintenance window
  • Monitor public advisories for any increase in exploit maturity
  • Audit private project merge request access logs for anomalous unauthenticated attempts
  • Enforce least-privilege project visibility settings as an additional control

The record

An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2 in which an unauthenticated user may be able to read some information about an MR in a private project, under certain circumstances.

Affected packages

Ecosystem Package Introduced Fixed
Bitnami gitlab 17.3.0 17.3.7
Ubuntu:16.04:LTS gitlab 0 No fix
Ubuntu:Pro:16.04:LTS gitlab 0 No fix

Related vulnerabilities