EUVD-2024-54992CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
5Description
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all versions starting from 17.1.0 before 17.1.1 which allowed for a CSRF attack on GitLab's GraphQL API leading to the execution of arbitrary GraphQL mutations.
Analysis
CVE-2024-4994 is a Cross-Site Request Forgery (CSRF) vulnerability in GitLab's GraphQL API that allows unauthenticated attackers to execute arbitrary GraphQL mutations through a malicious website visited by authenticated GitLab users. This affects GitLab CE/EE versions 16.1.0-16.11.4, 17.0.0-17.0.2, and 17.1.0, with a CVSS score of 8.1 indicating high severity. The vulnerability requires user interaction (clicking a malicious link) but can result in unauthorized data manipulation or system compromise depending on the mutations executed.
Technical Context
The vulnerability exists in GitLab's GraphQL API endpoint implementation, which failed to implement proper CSRF token validation for state-changing operations (mutations). GraphQL mutations are the write/modification operations within GraphQL, analogous to POST/PUT/DELETE in REST APIs. The root cause is CWE-352 (Cross-Site Request Forgery), where the API accepts authenticated GraphQL mutation requests from cross-origin sources without verifying that the request originated from a legitimate GitLab interface. This is a classic CSRF vulnerability pattern where an attacker crafts a malicious webpage containing GraphQL mutation payloads that execute when a logged-in user visits the attacker's site. The vulnerability affects CPE:2.3:a:gitlab:gitlab:* versions spanning multiple release branches (16.1.x, 17.0.x, 17.1.x), indicating the vulnerability was introduced or persisted across multiple major releases.
Affected Products
GitLab Community Edition (CE) and Enterprise Edition (EE) with the following vulnerable version ranges: (1) 16.1.0 through 16.11.4 (all 16.1.x, 16.2.x through 16.11.x versions); (2) 17.0.0 through 17.0.2 (all early 17.0.x versions); (3) 17.1.0 (17.1.0 specifically, likely fixed in 17.1.1+). CPE identifiers: cpe:2.3:a:gitlab:gitlab:* (versions as listed above). Users running GitLab versions 16.11.5 or later in the 16.x branch, 17.0.3 or later in the 17.0 branch, or 17.1.1 or later in the 17.1 branch are not affected. Self-managed and SaaS GitLab instances are both potentially vulnerable if unpatched.
Remediation
Immediate remediation: (1) Upgrade GitLab to patched versions: 16.11.5 or later (for 16.1.x-16.11.x users), 17.0.3 or later (for 17.0.x users), or 17.1.1 or later (for 17.1.x users); (2) Follow GitLab's official upgrade procedure to ensure database migrations and service restarts complete successfully. Short-term mitigations if immediate patching is not possible: (1) Implement Web Application Firewall (WAF) rules to detect and block GraphQL mutation requests originating from cross-origin sources (check for missing or invalid CSRF tokens on GraphQL endpoints); (2) Restrict GraphQL API access to trusted networks using network-level controls; (3) Implement Content Security Policy (CSP) headers to limit the ability of malicious sites to forge requests. Monitor for signs of exploitation by reviewing GraphQL mutation logs for suspicious activity, particularly mutations that alter user permissions, group memberships, or project data from unexpected sources. For GitLab.com SaaS users, GitLab has patched the platform; self-managed instances must apply patches manually.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| xenial | ignored | - |
| jammy | DNE | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| sid | vulnerable | 17.6.5-19 | - |
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today