CVE-2024-7102

Under specific circumstances, an authenticated attacker can cause a CI/CD pipeline to be executed in the context of another user's identity. This means the pipeline will be executed with the victim's permissions and tokens, not the attacker's. The detailed mechanism for triggering the situation has not been publicly disclosed, however the vulnerability concerns the authorization logic for pipeline invocation.

An attacker can take control of another user's pipeline, gaining access to their secrets, CI/CD variables, and resources they have permissions for. In production environments, this can lead to theft of credentials, code integrity violations, or lateral movement in the infrastructure.

GitLab CE/EE must be updated to version 17.5.0 or later. Detailed information about available patches can be found in the vendor references at https://gitlab.com/gitlab-org/gitlab/-/issues/474414

GitLab CE and EE, all versions from 16.4 to 17.5.0 (excluding 17.5.0)