CVE-2024-4283

What it actually does

Open redirect in OAuth flow under specific conditions allows an attacker to interrupt the authorization callback and hijack the resulting session or access token, enabling account takeover.

Why it matters to the business

Attackers can gain unauthorized access to repositories, issues, and other project data, potentially leading to data breaches or supply-chain compromise in organizations using GitLab EE.

How an attack unfolds

An attacker crafts a malicious redirect_uri that breaks the OAuth state validation, sends a phishing link to a victim, and intercepts the authorization code or token when the victim completes authentication, ultimately taking over the account.

How to fix it

Upgrade GitLab EE to 17.1.7, 17.2.5, or 17.3.2 (or later commits containing 84cf95d60d2691201b17bb4d41a95987ded847fb).

How to confirm the fix worked

Verify the running GitLab version is at or above the fixed releases; inspect OAuth application settings and callback URLs for unexpected external domains.

Typical attack path

1. Locate an OAuth-protected endpoint in GitLab EE
2. Craft a redirect_uri pointing to an attacker-controlled domain that satisfies the vulnerable conditions
3. Deliver the crafted link via phishing or other social engineering
4. Victim authenticates and is redirected, leaking the authorization code or token
5. Attacker exchanges the leaked credential for a valid session and assumes control of the account

How to detect it

Examine web server and application logs for OAuth callback requests containing unexpected or attacker-controlled redirect_uri values; correlate with successful authentication events followed by unusual account activity.

What your security team should do

• Apply the listed version upgrades as soon as possible
• Audit all configured OAuth applications and restrict redirect URIs to known domains
• Enable and review authentication and OAuth callback logs for anomalous redirect patterns
• Consider additional monitoring for account takeover indicators such as unexpected password resets or session creations