CVE-2024-11668

What it actually does

Long-lived connections bypass authentication controls to access streaming results without proper authorization.

Why it matters to the business

Attackers could gain unauthorized access to sensitive streaming data, leading to data exposure and potential compliance violations in organizations using affected GitLab instances.

How an attack unfolds

An attacker establishes a long-lived connection to a GitLab instance and leverages the authentication bypass to retrieve streaming results that should be protected.

How to fix it

Upgrade GitLab CE/EE to 17.4.5 or later, 17.5.3 or later, or 17.6.1 or later. Apply the fix commit 3ead12a16d7bd8f1c481504e03042aaf6e10f108 where applicable.

How to confirm the fix worked

Verify the installed GitLab version is at or above the fixed releases and test that authentication is enforced on streaming endpoints for long-lived connections.

Typical attack path

1. Identify a vulnerable GitLab instance running an affected version
2. Establish a long-lived connection to the streaming endpoint
3. Bypass authentication checks due to the flaw
4. Access and exfiltrate unauthorized streaming results

How to detect it

Review GitLab access and audit logs for long-lived connections that succeeded without expected authentication tokens or session validation around streaming result endpoints.

What your security team should do

• Immediately upgrade all GitLab instances to the fixed versions
• Monitor for any anomalous long-lived connections to streaming endpoints
• Review access logs for potential unauthorized streaming data access