CVE-2024-6446

What it actually does

The vulnerability permits a crafted URL to trigger an open redirect that causes a victim to trust and interact with an attacker-controlled application instead of the intended GitLab resource.

Why it matters to the business

Successful exploitation can lead to phishing campaigns that result in credential theft, unauthorized access to repositories, or supply-chain compromise across organizations relying on GitLab for code collaboration.

How an attack unfolds

An attacker crafts a GitLab URL containing a malicious redirect target pointing to an attacker-controlled domain. The link is delivered to a victim through email, chat, or other channels. When the victim clicks it, the open redirect causes the browser to follow the attacker-controlled destination, allowing the attacker to harvest credentials or deliver malware under the appearance of legitimacy.

How to fix it

Upgrade all affected GitLab instances to a version containing commit 84cf95d60d2691201b17bb4d41a95987ded847fb (17.1.8, 17.2.5, 17.3.2 or later). Validate the upgrade completes successfully and test that redirect URLs no longer allow external domains.

How to confirm the fix worked

Confirm the running GitLab version is at or above the fixed releases, review application configuration for redirect allow-lists, and attempt to trigger the original redirect vector to verify it is blocked.

Typical attack path

1. Identify a vulnerable GitLab instance and construct a URL that abuses the open redirect parameter
2. Host a convincing attacker-controlled application at the target domain
3. Distribute the crafted link via phishing email, messaging, or social engineering
4. Victim authenticates or interacts with the malicious site under the false belief it is trusted
5. Attacker captures credentials, session tokens, or performs further social engineering

How to detect it

Search web access logs and application logs for GitLab URLs containing redirect parameters that point to external or unexpected domains, and review authentication events that originate from redirected sessions.

What your security team should do

• Prioritize patching all GitLab instances to the fixed versions containing commit 84cf95d60d2691201b17bb4d41a95987ded847fb within the next maintenance window
• Enable strict allow-listing for any redirect functionality and monitor logs for external redirect attempts
• Conduct a post-patch audit of user accounts for signs of unauthorized access