CVE-2024-8754

What it actually does

Improper input validation in GitLab's JWT authentication flow permits an attacker to associate arbitrary unclaimed external provider identities with existing accounts, enabling account takeover without proper ownership verification.

Why it matters to the business

Attackers can hijack user accounts in organizations using JWT-based SSO, leading to unauthorized access to source code, issues, pipelines, and other sensitive project data with potential for persistent compromise until the flaw is addressed.

How an attack unfolds

An attacker identifies a target GitLab instance with JWT authentication enabled, crafts a malicious provider identity claim matching an unclaimed external identity, and submits it through the linking endpoint; the lack of validation accepts the claim and grants the attacker control over the victim's account.

How to fix it

Upgrade GitLab EE/CE to 17.1.7 or later, 17.2.5 or later, or 17.3.2 or later (incorporating commit 84cf95d60d2691201b17bb4d41a95987ded847fb) to enforce proper validation of provider identities during JWT account linking.

How to confirm the fix worked

After upgrade, attempt to link an unclaimed provider identity via the JWT flow and confirm the request is rejected; review authentication logs for any prior successful linking events from unknown providers.

Typical attack path

1. Discover GitLab instance with JWT auth configured
2. Identify target user accounts and their potential external providers
3. Craft and submit forged provider identity linking request
4. Gain authenticated session as the hijacked account
5. Access or exfiltrate repositories and perform privileged actions

How to detect it

Search GitLab authentication and identity linking logs for unexpected provider identity associations; look for API calls to account linking endpoints originating from external IPs or using unusual JWT claims around the time of publication.

What your security team should do

• Immediately upgrade all affected GitLab instances to the fixed versions
• Audit existing linked external identities for any anomalous associations
• Temporarily disable JWT authentication if upgrade cannot be performed promptly
• Monitor authentication and account linking logs for suspicious activity
• Review and enforce strict identity verification policies for SSO integrations