CVE-2024-6389

What it actually does

Authorization bypass in the release Atom endpoint permits guest users to retrieve commit metadata that should be restricted by project permissions.

Why it matters to the business

Organizations using affected GitLab versions risk unintended disclosure of commit details to users without proper access, potentially exposing development activity or sensitive change information.

How an attack unfolds

An attacker creates or uses a guest-level account, navigates to a project release Atom feed endpoint, and receives commit information that the authorization checks should have blocked.

How to fix it

Upgrade GitLab to 17.1.7, 17.2.5, or 17.3.2 (or later) which contain the fix commit 84cf95d60d2691201b17bb4d41a95987ded847fb. Apply patches immediately on internet-facing instances.

How to confirm the fix worked

After upgrade, confirm guest users can no longer retrieve commit data via the release Atom endpoint on projects where they lack permission; review release notes for the applied version.

Typical attack path

1. Obtain or create a guest account on the GitLab instance
2. Identify a target project and its release Atom endpoint URL
3. Issue a request to the endpoint without elevated permissions
4. Parse the returned Atom feed to extract commit metadata

How to detect it

Review web server and GitLab application logs for requests to release Atom endpoints originating from guest-authenticated sessions; correlate with project access logs for unexpected commit metadata retrieval.

What your security team should do

• Prioritize upgrade of all GitLab instances to the fixed releases within the next maintenance window
• Audit guest user access on projects containing sensitive repositories
• Enable enhanced logging on release endpoints to monitor for anomalous access patterns