Cloudanix VulnDB

CVE-2024-2177

Medium · 6.8

CVSS

6.8

EPSS

0.7%

Published

Jul 9, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A problem in how GitLab handles sign-ins through other accounts could let attackers slip into user accounts by tricking the login process across browser windows.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Privilege Gain
Component
Application
Class
CSRF
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw enables cross-window forgery in the OAuth authentication flow, allowing crafted payloads to manipulate browser window interactions and bypass intended authorization checks to obtain unauthorized access tokens or sessions.

Why it matters to the business

Successful exploitation could result in unauthorized access to source code repositories, project data, and user accounts, increasing risk of intellectual property theft or supply-chain compromise in organizations relying on GitLab.

How an attack unfolds

An attacker prepares a malicious site or payload that opens or interacts with GitLab OAuth windows; by abusing cross-window communication and timing during the authentication redirect, the attacker forges requests that complete the OAuth flow on behalf of the victim.

How to fix it

Upgrade GitLab CE/EE to 16.11.5, 17.0.3, or 17.1.1 (or newer) as appropriate for the installed branch; apply the commit containing 1c964efc9c74e98a604c02dfaed5f4097518ac00 where backports are used.

How to confirm the fix worked

Confirm the running GitLab version meets or exceeds the fixed releases; retest OAuth application authorization flows to ensure cross-window requests are properly validated and rejected when forged.

Typical attack path

  1. Prepare crafted OAuth payload targeting vulnerable GitLab instance
  2. Lure authenticated user to attacker-controlled page or window
  3. Trigger cross-window forgery during OAuth redirect sequence
  4. Obtain valid access tokens or session hijacking
  5. Access or modify repositories and user data

How to detect it

Review GitLab authentication and OAuth logs for unexpected redirect patterns, rapid window or popup activity during sign-in, or successful authorizations originating from suspicious referrers.

What your security team should do

  • Prioritize patching all GitLab instances to the fixed versions listed
  • Audit and restrict OAuth applications and redirect URIs
  • Enable enhanced logging for authentication events and review for anomalies
  • Educate users on risks of interacting with untrusted OAuth prompts

The record

A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload.

Affected packages

Ecosystem Package Introduced Fixed
Bitnami gitlab 16.3.0 16.11.5
Ubuntu:16.04:LTS gitlab 0 No fix
Ubuntu:Pro:16.04:LTS gitlab 0 No fix

Related vulnerabilities