CVE-2024-8974

What it actually does

The flaw permits an unauthorized user to retrieve the filesystem path of a private project when specific request conditions are met.

Why it matters to the business

Disclosure of private project locations can expose internal structure details that assist targeted follow-on attacks, increasing risk of data exposure or intellectual property loss in organizations using the platform.

How an attack unfolds

An attacker with basic access crafts requests to project-related endpoints that trigger the authorization bypass, causing the server to return the private project path in the response.

How to fix it

Upgrade all GitLab EE/CE instances to 17.2.8, 17.3.4, or 17.4.1 (or later) as these releases contain the fix for the authorization check.

How to confirm the fix worked

Confirm the running version meets or exceeds the fixed releases, then test that requests from unauthorized accounts no longer return private project paths.

Typical attack path

1. Locate a GitLab instance running an affected version
2. Identify or create an account with limited permissions
3. Send specially formed requests to project metadata endpoints
4. Capture the unauthorized disclosure of the private project path in the server response
5. Leverage the path information for further reconnaissance or attack planning

How to detect it

Examine web server and application logs for requests to project path endpoints returning unexpected internal paths from low-privileged accounts.

What your security team should do

• Apply the listed GitLab upgrades without delay
• Audit project visibility and access policies
• Enable enhanced logging on project metadata endpoints