GitLab Faces Critical CI/CD Vulnerability Impacting Multiple Versions

A severe security vulnerability has been identified and patched in GitLab’s platform. The most critical issue (tracked as CVE-2024-9164) enables attackers to circumvent branch protection mechanisms, potentially allowing them to initiate CI/CD pipelines on any branch within a repository without proper authorization. This security flaw has been assigned a CVSS v3.1 severity rating of 9.6 out of 10, highlighting its significant impact. Exploiting this vulnerability could lead to unauthorized code execution or exposure of confidential data. GitLab has released security updates to remediate this and other identified vulnerabilities.

This security issue impacts multiple versions of GitLab Enterprise Edition (EE), spanning several major releases. Specifically, the vulnerability is present in:

• All versions from 12.5 through 17.2.8
• Versions 17.3 through 17.3.4
• Versions 17.4 through 17.4.1

To mitigate the security risk, GitLab strongly recommends that users promptly update their installations to one of the following patched versions:

• Version 17.4.2
• Version 17.3.5
• Version 17.2.9

Immediate action is advised to prevent potential security breaches. However, customers using GitLab Dedicated, require no actions as their instances are automatically maintained with the latest security updates.

Title	Severity
Run pipelines on arbitrary branches	Critical
An attacker can impersonate arbitrary user	High
SSRF in Analytics Dashboard	High
Viewing diffs of MR with conflicts can be slow	High
HTMLi in OAuth page	High
Deploy Keys can push changes to an archived repository	Medium
Guests can disclose project templates	Medium
GitLab instance version disclosed to unauthorized users	Low

This pipeline vulnerability is not an isolated incident for GitLab, as the platform has addressed several similar critical security issues throughout the year. Notable recent fixes include:

• CVE-2024-6678 discovered in August
• CVE-2024-6385 found in July
• CVE-2024-5655 identified in June

For comprehensive update guidance, GitLab directs users to their official download portal. There, users can find:

• Detailed installation instructions
• Access to source code
• Various software packages
• Updated GitLab Runner components

This recurring pattern of pipeline-related vulnerabilities emphasizes the importance of staying current with GitLab’s security updates.

• GitLab Critical Patch Release: 17.4.2, 17.3.5, 17.2.9 | GitLab
• GitLab warns of critical arbitrary branch pipeline execution flaw (bleepingcomputer.com)