CVE-2024-9164

The vulnerability results from insufficient permission verification (CWE-306 — missing authentication for critical function) before running a pipeline on the specified branch. An attacker with basic access to a GitLab EE instance can trigger a pipeline on any repository branch to which they normally should not have execution rights. The attack vector is network-based, requires no victim interaction or high privileges, and the scope extends beyond the source component (Scope: Changed).

An attacker can run CI/CD pipelines on arbitrary branches, which may lead to disclosure of sensitive secrets and environment variables embedded in the pipeline, as well as compromise the integrity of the software building and deployment process.

GitLab EE should be updated to version 17.2.9, 17.3.5, or 17.4.2 (or newer). The vendor has provided patches eliminating the vulnerability in all mentioned release branches. Until updating, it is recommended to restrict access to repositories and monitor unauthorized pipeline executions.

GitLab Enterprise Edition (EE) in all versions from 12.5 to 17.2.8 inclusive, from 17.3.0 to 17.3.4 inclusive, and from 17.4.0 to 17.4.1 inclusive.