Cloudanix VulnDB

CVE-2024-4539

Medium · 4.3

CVSS

4.3

EPSS

0.8%

Published

May 14, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in GitLab lets someone with an account deliberately overload the service so that other users cannot access it.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Abuse of the branch and tag filtering API endpoints allows an authenticated user to trigger excessive resource consumption, resulting in denial of service.

Why it matters to the business

GitLab instances can become unavailable or severely degraded, interrupting development workflows, code reviews, and CI/CD pipelines for extended periods; urgency remains low given stable low EPSS and no known exploitation.

How an attack unfolds

An attacker with a low-privileged account repeatedly invokes the branch or tag listing API while supplying crafted filter parameters that force the server to perform expensive database or computation work, gradually exhausting CPU, memory, or connection resources until the service is unresponsive.

How to fix it

Upgrade GitLab CE/EE to 16.9.7 or later, 16.10.5 or later, or 16.11.2 or later. If immediate upgrade is not possible, restrict API access to branch/tag endpoints for non-administrative users via network controls or application settings.

How to confirm the fix worked

Confirm the running GitLab version is at or above one of the fixed releases; test that calls to the branch and tag filter APIs complete quickly and do not produce sustained high CPU or memory usage under load.

Typical attack path

  1. Obtain a valid low-privileged GitLab account or token
  2. Identify repositories with large numbers of branches or tags
  3. Issue repeated requests to the branches or tags filtering API endpoints with malicious filter parameters
  4. Sustain the request volume until server resources are exhausted

How to detect it

Inspect GitLab application and audit logs for repeated high-volume calls to branch and tag listing endpoints; correlate with sudden spikes in CPU, memory, or database load on the GitLab server.

What your security team should do

  • Schedule upgrade to a fixed release within normal change windows given low EPSS and absence from KEV
  • Monitor GitLab application logs and system metrics for spikes correlated with branch/tag API usage
  • Review and tighten API rate limits for non-administrative users if upgrade cannot be applied immediately

The record

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 where abusing the API to filter branch and tags could lead to Denial of Service.

Affected packages

Ecosystem Package Introduced Fixed
Bitnami gitlab 15.4.0 16.9.7
Ubuntu:16.04:LTS gitlab 0 No fix
Ubuntu:Pro:16.04:LTS gitlab 0 No fix

Related vulnerabilities