Description: An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches.
CVE-2024-9164
Published Date: 2024-10-11T13:15:17.700
Last Modified: 2024-10-11T13:15:17.700
CVSS Score: 9.6 (CRITICAL)
EPSS Score: 0.04%
Risk Score: 6.72 (HIGH)
Risk Score based on CVSS score and EPSS. This score is for reference purposes and is not internationally recognized.
CVSS:
9.6 |
EPSS:
0.04%
Mitre ATT&CK Technical v15.1
Technical Analysis & Mitigation Measures
1. Technical Attack Analysis:
– Attack Techniques :
– T1203 – Exploitation for Client Execution : Attackers can exploit the vulnerability to execute arbitrary code by running pipelines on branches they should not have access to.
– T1071 – Application Layer Protocol : Attackers might use application layer protocols to manipulate GitLab functionalities, potentially injecting malicious code into the pipeline.
– T1496 – Resource Hijacking : This could lead to attackers utilizing the resources of the GitLab runner for unauthorized tasks, including cryptocurrency mining or other malicious activities.
– Possible Outcomes of Exploitation :
– Unauthorized execution of code in the CI/CD pipeline.
– Compromise of sensitive data or credentials stored in the repository.
– Disruption of CI/CD workflows leading to service outages.
– Deployment of malicious artifacts to production environments.
2. Mitigation Measures:
– Update GitLab to the latest version.
– Implement branch protection rules to restrict who can run pipelines.
– Limit permissions for users and groups in repository settings.
– Monitor and audit pipeline execution logs for anomalies.
– Utilize GitLab’s feature to require approval for merge requests.
– Educate developers about secure coding practices and the risks of pipeline execution.
– Employ Web Application Firewalls (WAF) to filter and monitor HTTP traffic to GitLab instances.
The content above is generated by AI. Please review and consider carefully before applying!
Reference Links
Vendor - Produce - Version
None
Disclaimer
The content on this website is automatically sourced from external websites such as the National Vulnerability Database (NVD), GitHub, and other security-related sources. This content is for reference purposes only, and we are not responsible for the accuracy or integrity of the information linked or displayed from these sources.