CVE-2024-6678

What it actually does

The flaw permits bypassing authorization checks to trigger CI/CD pipelines while impersonating any user account under specific conditions in GitLab.

Why it matters to the business

Attackers could force unauthorized builds, deployments, or secret exposures, leading to operational disruptions, intellectual property theft, or infrastructure compromise.

How an attack unfolds

An attacker identifies a vulnerable GitLab instance, crafts a pipeline trigger request exploiting the authorization bypass, and executes the pipeline as an arbitrary user to perform actions without proper permissions.

How to fix it

Upgrade GitLab CE/EE to 17.1.7 or later, 17.2.5 or later, or 17.3.2 or later as appropriate for the installed branch.

How to confirm the fix worked

Confirm the running GitLab version meets or exceeds the fixed releases listed above; review pipeline permission settings and test trigger authorization after upgrade.

Typical attack path

1. Locate a GitLab instance running an affected version
2. Identify a target user or project
3. Craft and submit a pipeline trigger request that bypasses authorization
4. Execute and monitor the pipeline running under the impersonated identity

How to detect it

Review GitLab audit and pipeline logs for unexpected trigger events or executions attributed to users who did not initiate them; monitor for anomalous pipeline activity in project histories.

• Audit log entries showing pipeline creation by mismatched or impersonated user IDs
• Pipeline execution records lacking corresponding user-initiated trigger events

What your security team should do

• Prioritize upgrade of all affected GitLab instances to the specified fixed versions
• Audit recent pipeline execution logs for suspicious triggers
• Restrict pipeline trigger permissions to the minimum necessary users