CVE-2024-8641

What it actually does

An attacker in possession of a victim's CI_JOB_TOKEN can exchange it for a valid GitLab session token belonging to the same victim, resulting in credential exposure.

Why it matters to the business

Attackers could impersonate users and perform unauthorized actions inside GitLab, risking source code theft, pipeline manipulation, or account takeover; the 759 days since publication without widespread exploitation reduces immediate urgency but still warrants patching.

How an attack unfolds

An attacker first obtains a victim's CI_JOB_TOKEN (for example via a compromised runner or log exposure), then submits it to GitLab in a crafted request that triggers issuance of the victim's session token, which the attacker can subsequently use to access the victim's account and resources.

How to fix it

Upgrade GitLab CE/EE to 17.1.7, 17.2.5, or 17.3.2 or later depending on the installed branch; apply the update as soon as possible given the elapsed time since disclosure.

How to confirm the fix worked

Confirm the running GitLab version matches or exceeds the fixed releases listed above and verify that CI_JOB_TOKEN to session token exchange behavior is no longer possible in a test environment.

Typical attack path

1. Obtain victim's CI_JOB_TOKEN through logs, runner compromise, or other means
2. Submit the token to GitLab in a request that triggers session token issuance
3. Capture the returned session token
4. Use the session token to authenticate as the victim and perform actions

How to detect it

Search GitLab access and audit logs for unusual session creations immediately following CI_JOB_TOKEN usage by the same user; look for authentication events where the originating token type differs from the resulting session.

What your security team should do

• Prioritize upgrade of all GitLab instances to a fixed version within the next sprint
• Audit CI runner configurations and logs for unintended exposure of CI_JOB_TOKEN values
• Review authentication and token handling policies to limit cross-token substitution risks