CVE-2024-5435

What it actually does

The vulnerability exposes plaintext passwords stored in repository mirror configurations to authorized users who should not have access to them.

Why it matters to the business

Organizations using GitLab for mirrored repositories risk credential leakage that could allow attackers to access external code repositories or connected services, potentially leading to source code theft or supply chain compromise.

How an attack unfolds

An attacker with sufficient permissions to view repository settings navigates to the mirror configuration page and retrieves the stored password directly from the disclosed field.

How to fix it

Upgrade GitLab EE/CE to version 17.1.7 or later, 17.2.5 or later, or 17.3.2 or later. The fix is included in commit 84cf95d60d2691201b17bb4d41a95987ded847fb.

How to confirm the fix worked

Verify the installed GitLab version is at or above the fixed releases; review mirror configuration pages to confirm passwords are no longer displayed in plaintext.

Typical attack path

1. Obtain access to a GitLab account with permissions to view project mirror settings
2. Navigate to the repository mirror configuration interface
3. Inspect the displayed configuration details to extract the plaintext password
4. Use the obtained credentials to access the external mirrored repository or related systems

How to detect it

Review GitLab application logs and audit events for accesses to mirror configuration endpoints or settings pages; look for unusual queries or views of repository mirror data.

What your security team should do

• Apply the listed version upgrades immediately across all affected GitLab instances
• Audit existing mirror configurations and rotate any exposed credentials
• Restrict access to repository settings to the minimum necessary users
• Monitor for any anomalous access to mirror configuration endpoints