CVE-2024-8641 Privilege Context Switching Error in GitLab

Medium 6.7 Published 12 Sep 2024 Updated 13 Sep 2024

An attacker with a victim's CI_JOB_TOKEN can obtain the victim's GitLab session token, leading to account takeover.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2024-8641?

CVE-2024-8641 is a medium-severity authentication bypass vulnerability in Gitlab Gitlab, published on 12 Sep 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It may have been possible for an attacker with a victim's CI_JOB_TOKEN to obtain a GitLab session token belonging to the victim.

Weakness: CWE-270

Which versions are affected by CVE-2024-8641?

1 open source package ship an affected version, including gitlab. It affects 1 product.

Package	Affected	Fixed in
`gitlab` Bitnami	From `13.7.0`	`17.1.7, 17.2.5, 17.3.2`

Products include Gitlab Gitlab.

How do I fix CVE-2024-8641?

Upgrade gitlab to a fixed version for your release line: 17.1.7, 17.2.5 or 17.3.2.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-8641 being exploited?

There is no known exploitation of CVE-2024-8641 in the wild and no public exploit code.

All Gitlab Gitlab vulnerabilities

Sources

Also known as BIT-gitlab-2024-8641, GHSA-x654-52cq-hxj3, UBUNTU-CVE-2024-8641.