CVE-2024-9164

What it actually does

The flaw bypasses authorization checks allowing authenticated users to trigger CI/CD pipeline execution on arbitrary branches they lack permissions for in GitLab EE.

Why it matters to the business

Organizations face risk of unauthorized code builds that could expose secrets, run unvetted code, or disrupt development pipelines; the issue affects widely deployed GitLab instances used in software development.

How an attack unfolds

An attacker with basic project access crafts API or web requests specifying unauthorized branch names when triggering pipelines; the missing authorization enforcement permits the pipeline to run on the chosen branch, enabling further actions such as secret access or malicious job execution.

How to fix it

Upgrade GitLab EE to 17.2.9, 17.3.5, 17.4.2 or later; the fix is included in commit 91146650fd2d7d080662a536b1d04a5c96f451be. Apply the update across all instances and verify no custom pipeline configurations rely on the bypassed checks.

How to confirm the fix worked

Confirm the running GitLab version meets or exceeds the fixed releases; attempt to trigger pipelines on restricted branches after the update and verify that authorization denials are enforced.

Typical attack path

1. Obtain authenticated access to a GitLab EE project
2. Identify pipeline trigger endpoints or UI paths
3. Craft requests containing arbitrary branch references
4. Submit the request to execute the pipeline
5. Use successful pipeline run to access artifacts, secrets, or perform additional actions

How to detect it

Search GitLab application and audit logs for pipeline trigger events where the branch name does not match the user's expected permissions; look for API calls to pipeline endpoints containing unexpected branch parameters.

What your security team should do

• Prioritize upgrade of all GitLab EE instances to the fixed versions within the next maintenance window
• Review and tighten branch protection rules and pipeline trigger permissions
• Enable enhanced logging for pipeline creation events
• Audit recent pipeline runs for executions on unexpected branches