CVE-2024-1451: GitLab Stored XSS Vulnerability

CVE-2024-1451 Overview

CVE-2024-1451 is a stored cross-site scripting (XSS) vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 16.9 up to but not including 16.9.1. An authenticated attacker can inject a crafted payload into the user profile page. When another user views that profile, the payload executes in the victim's browser context. The vulnerability is tracked under CWE-79 and is rated HIGH with a CVSS score of 8.7.

Critical Impact
Successful exploitation allows attackers to perform arbitrary actions on behalf of authenticated GitLab users, including session hijacking, repository tampering, and CI/CD pipeline abuse.

Affected Products

GitLab Community Edition (CE) version 16.9.0
GitLab Enterprise Edition (EE) version 16.9.0
All GitLab CE/EE deployments starting from 16.9 before 16.9.1

Discovery Timeline

2024-02-22 - CVE-2024-1451 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1451

Vulnerability Analysis

CVE-2024-1451 is a stored (persistent) XSS vulnerability located in the GitLab user profile page. GitLab fails to properly sanitize or encode user-supplied input before rendering it in the profile view. An attacker with a valid GitLab account can inject JavaScript into a profile field. That payload persists in the database and executes each time another user visits the malicious profile.

Because the payload runs in the victim's authenticated session, it inherits the victim's privileges. Attackers can invoke the GitLab API, exfiltrate source code, add SSH keys, or modify CI/CD configurations. The scope change reflected in the CVSS vector indicates the impact extends beyond the vulnerable component into the victim's browser trust context.

The attack requires low privileges and user interaction, meaning the victim must load the crafted profile. In a collaborative platform like GitLab, this interaction is trivial to trigger through merge request participation, issue mentions, or direct links.

Root Cause

The root cause is missing or insufficient output encoding of user-controlled profile fields. GitLab renders attacker-supplied content into the HTML response without neutralizing script-capable characters. This maps to CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation follows a standard stored XSS pattern:

The attacker registers or uses an existing GitLab account.
The attacker edits a profile field with a crafted HTML or JavaScript payload.
A victim visits the attacker's profile page.
The victim's browser executes the payload under the GitLab origin.
The attacker leverages the session to act as the victim.

No public proof-of-concept exploit code is available in the referenced advisories. Technical details are tracked in GitLab Issue #441457 and HackerOne Report #2371126.

Detection Methods for CVE-2024-1451

Indicators of Compromise

Profile field values in the GitLab database containing HTML tags such as <script>, <img onerror=>, or javascript: URIs
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after visiting a GitLab profile page
Sudden creation of personal access tokens, SSH keys, or webhook additions by users who did not initiate those actions
Unauthorized API calls originating from legitimate user sessions immediately after profile page views

Detection Strategies

Audit the users table and related profile field storage for markup or script-like content injected by non-administrative accounts
Deploy a Content Security Policy (CSP) in report-only mode to identify inline script executions from GitLab origins
Correlate GitLab audit events for token creation and SSH key additions with recent visits to third-party user profiles
Review reverse proxy or WAF logs for GET requests to /users/<username> immediately preceded by suspicious session activity

Monitoring Recommendations

Enable GitLab audit event streaming for user profile changes and forward events to a centralized SIEM
Alert on unusual patterns of PAT (personal access token) issuance and SSH key addition events
Monitor for API activity that deviates from a user's historical baseline, particularly writes to CI/CD variables and protected branches
Track browser-reported CSP violations for any GitLab hostnames under organizational control

How to Mitigate CVE-2024-1451

Immediate Actions Required

Upgrade all self-managed GitLab CE and EE instances running 16.9.0 to version 16.9.1 or later without delay
Review the profile fields of all users created or modified since deploying 16.9.0 for injected markup
Rotate personal access tokens, SSH keys, and session cookies for any account suspected of viewing malicious profiles
Verify that GitLab.com SaaS tenants are on the patched release; GitLab.com is maintained by the vendor

Patch Information

GitLab addressed CVE-2024-1451 in version 16.9.1. Administrators of self-managed instances should follow the standard GitLab upgrade procedure and confirm the running version via gitlab-rake gitlab:env:info or the /help endpoint after the upgrade completes. Refer to GitLab Issue #441457 for advisory details.

Workarounds

No official workaround has been published; upgrading to 16.9.1 is the supported remediation
As a temporary compensating control, restrict new user registrations and enforce administrator approval for new accounts to reduce the pool of potential attackers
Deploy a strict Content Security Policy that disallows inline scripts and unsafe-eval on the GitLab origin
Limit access to the GitLab instance to trusted networks via VPN or IP allowlisting until patching is complete

bash

# Example: upgrade a Debian/Ubuntu Omnibus GitLab instance to a patched release
sudo apt-get update
sudo apt-get install gitlab-ce=16.9.1-ce.0
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart
gitlab-rake gitlab:env:info | grep -i version