CVE-2024-12380 Overview
CVE-2024-12380 is an information disclosure vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw resides in repository mirroring settings, where certain user inputs can expose sensitive authentication information. The issue affects all versions from 11.5 before 17.7.7, 17.8 before 17.8.5, and 17.9 before 17.9.2. The vulnerability is classified under [CWE-209] (Generation of Error Message Containing Sensitive Information) and is exploitable over the network without authentication or user interaction.
Critical Impact
Unauthenticated network attackers can potentially retrieve sensitive authentication credentials used for repository mirroring, compromising the confidentiality of mirrored source code repositories.
Affected Products
- GitLab Community Edition (CE) versions 11.5 through 17.7.6
- GitLab Enterprise Edition (EE) versions 17.8 through 17.8.4
- GitLab CE/EE versions 17.9 through 17.9.1
Discovery Timeline
- 2025-03-13 - CVE-2024-12380 published to the National Vulnerability Database
- 2025-08-06 - Last updated in NVD database
Technical Details for CVE-2024-12380
Vulnerability Analysis
The vulnerability stems from improper handling of user-supplied inputs within GitLab's repository mirroring configuration. Repository mirroring allows GitLab to maintain synchronized copies of repositories hosted on external Git services. To perform synchronization, GitLab stores authentication credentials such as access tokens, usernames, and passwords for the upstream or downstream service.
When certain inputs are processed during mirroring operations, the application can return error messages or responses that disclose portions of the stored authentication material. This behavior aligns with [CWE-209], where sensitive information leaks through error responses or diagnostic output. An unauthenticated remote attacker can interact with the affected endpoints over the network without privileges or user interaction.
Root Cause
The root cause is insufficient sanitization of error output and response data generated by the repository mirroring subsystem. Authentication tokens and credentials supplied for mirror configuration are not consistently redacted from messages exposed to API consumers or unauthenticated requests. The flaw impacts confidentiality but does not affect integrity or availability.
Attack Vector
An attacker submits crafted requests to repository mirroring endpoints on a vulnerable GitLab instance. The application responds with information that includes elements of stored mirror credentials. Because the attack vector is network-based and requires no authentication, internet-exposed GitLab instances face the highest exposure. Successful exploitation can yield credentials that grant access to mirrored external repositories.
No verified public proof-of-concept code is available for this issue. Refer to the GitLab Issue #508557 and the HackerOne Report #2868951 for vendor-confirmed technical context.
Detection Methods for CVE-2024-12380
Indicators of Compromise
- Unexpected access to upstream or downstream mirrored repositories using GitLab-stored credentials
- Anomalous outbound authentication attempts from systems holding mirrored repository credentials
- Unusual API requests targeting /projects/*/mirror or repository mirroring configuration endpoints
Detection Strategies
- Review GitLab application logs for repeated requests to repository mirroring endpoints from unauthenticated or low-privilege sources
- Audit responses from mirror configuration APIs to identify error messages that include credential-related fields
- Correlate API access logs with subsequent authentication events on mirrored Git services to detect credential reuse
Monitoring Recommendations
- Enable verbose audit logging on GitLab API endpoints, particularly those related to project mirroring and integrations
- Forward GitLab production logs to a centralized analytics platform for retention and search
- Establish alerting on credential rotation events and on Git authentication failures originating from unfamiliar source addresses
How to Mitigate CVE-2024-12380
Immediate Actions Required
- Upgrade GitLab CE/EE to version 17.7.7, 17.8.5, 17.9.2, or later as appropriate for your deployment branch
- Rotate all credentials, tokens, and passwords configured for repository mirroring after upgrading
- Audit existing repository mirror configurations to identify and remove unused or stale mirror entries
Patch Information
GitLab released fixed versions 17.7.7, 17.8.5, and 17.9.2 that address the disclosure in repository mirroring. Self-managed administrators should apply the upgrade immediately. GitLab.com SaaS users are already running the patched version. See GitLab Issue #508557 for vendor remediation details.
Workarounds
- Temporarily disable repository mirroring for projects that do not require it until the upgrade is applied
- Restrict network access to the GitLab instance using a web application firewall or reverse proxy to limit exposure of mirroring endpoints
- Use short-lived access tokens with minimal scope for any mirror configurations that must remain active during the remediation window
# Verify the installed GitLab version after upgrade
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5
# Example: list projects with mirroring enabled for audit
sudo gitlab-rails runner "Project.where(mirror: true).find_each { |p| puts p.full_path }"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
