CVE-2024-8179

What it actually does

Improper output encoding allows injection of malicious scripts that execute in user browsers when Content Security Policy is disabled.

Why it matters to the business

Attackers could hijack user sessions, steal data, or perform actions on behalf of victims, increasing risk of account takeover and compliance issues; low exploit probability but affects many self-hosted instances.

How an attack unfolds

An attacker submits crafted input containing script tags or event handlers to a GitLab feature; due to missing encoding the payload renders and executes in victim browsers lacking CSP protection.

How to fix it

Upgrade GitLab CE/EE to 17.4.6, 17.5.4, or 17.6.2 or later; enable Content Security Policy as a defense-in-depth measure.

How to confirm the fix worked

Confirm upgrade via version endpoint or package manager; verify CSP headers are present in responses; test input fields for encoding of special characters.

Typical attack path

1. Identify a GitLab input field that reflects user data without encoding
2. Craft and submit a payload with executable script content
3. Trick an authenticated user into viewing the affected page
4. Script executes in browser, performing actions such as session theft or privilege escalation

How to detect it

Inspect web server and application logs for unexpected script tags or event handlers in requests and responses; look for user-generated content that was not sanitized.

What your security team should do

• Apply the listed GitLab version upgrades immediately
• Enable CSP across all instances if not already active
• Review audit logs for unusual user actions or script-related entries
• Monitor EPSS trend for any increase in exploitation likelihood