CVE-2024-8312

What it actually does

Unsanitized user input in the Global Search field on a diff view allows arbitrary HTML injection, resulting in cross-site scripting execution in the victim's browser context.

Why it matters to the business

Attackers may hijack user sessions, steal source code or credentials, or perform unauthorized actions within GitLab instances, potentially disrupting development workflows and exposing intellectual property.

How an attack unfolds

An attacker crafts a malicious payload containing HTML or JavaScript, submits it via the Global Search field while viewing a diff, and tricks a victim into loading the affected page so the script executes in their session.

How to fix it

Upgrade GitLab to versions 17.3.6, 17.4.3, or 17.5.1 or later; apply the commit cf36eeb39e6b055c08297149dc98ad1cc90248be where applicable. For SUSE packages listed, apply the referenced aspell updates if those components are in use.

How to confirm the fix worked

Verify the installed GitLab version against the fixed releases, review changelog entries for the search and diff components, and test that HTML input in the Global Search field on diff views is properly escaped or rejected.

Typical attack path

1. Identify a GitLab instance running an affected version between 15.10 and the fixed releases.
2. Navigate to a diff view and inject crafted HTML into the Global Search field.
3. Deliver a link or lure a victim user to load the manipulated diff view.
4. Execute arbitrary client-side code to steal tokens, cookies, or perform actions on behalf of the victim.

How to detect it

Inspect web server and GitLab application logs for anomalous search parameters containing HTML tags or script elements on diff endpoints; monitor for unexpected JavaScript execution or new user sessions originating from diff views.

What your security team should do

• Prioritize upgrade of all GitLab instances to the fixed versions immediately given the public disclosure.
• Enable Content-Security-Policy headers and audit any custom search or diff rendering extensions.
• Review user activity logs for unusual search queries containing script tags or event handlers around the publication date.
• Communicate the update requirement to development teams relying on GitLab.