CVE-2024-9387

What it actually does

The flaw permits manipulation of the releases API endpoint to perform an unauthorized open redirect to an arbitrary external URL.

Why it matters to the business

Attackers can phish users or send them to malicious sites, risking credential theft, data exposure, and erosion of platform trust; widespread use of the affected software increases potential blast radius.

How an attack unfolds

An attacker locates a vulnerable releases API endpoint, crafts a request containing a malicious redirect target, and lures a victim into accessing the URL, resulting in the victim being sent to an attacker-controlled destination.

How to fix it

Upgrade GitLab CE/EE to 17.4.6, 17.5.4, or 17.6.2 (commit 25a55583bbcf724ad625848d48a529467e7c7097) or later; apply linux-hwe package updates to 4.8.0-39.42~16.04.1 where applicable.

How to confirm the fix worked

Confirm the running version meets or exceeds the fixed releases, then test the releases API endpoint to verify that external redirects are blocked or properly sanitized.

Typical attack path

1. Scan or enumerate to identify a vulnerable GitLab instance exposing the releases API endpoint
2. Craft a request URL that includes a malicious external redirect parameter
3. Deliver the crafted link via phishing or other social engineering
4. Victim browser follows the redirect to the attacker site

How to detect it

Inspect web server and application logs for requests to the releases API endpoint that contain external redirect targets or unusual parameters; correlate with user reports of unexpected redirects.

What your security team should do

• Apply the listed GitLab upgrades immediately on all affected instances
• Review and tighten redirect validation controls in API endpoints
• Monitor web logs for anomalous requests to the releases API