CVE-2024-2177 Overview
CVE-2024-2177 is a Cross Window Forgery vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. An attacker can abuse the OAuth authentication flow using a crafted payload to trick an authenticated victim into performing unintended actions. The weakness is classified under CWE-1021 (Improper Restriction of Rendered UI Layers or Frames). Successful exploitation requires user interaction, but can lead to high impact on confidentiality and integrity of the victim account.
Critical Impact
An attacker can hijack a victim's OAuth authorization flow and gain access to protected resources tied to the victim's GitLab account.
Affected Products
- GitLab CE/EE versions 16.3 up to (but not including) 16.11.5
- GitLab CE/EE versions 17.0 up to (but not including) 17.0.3
- GitLab CE/EE versions 17.1.0 up to (but not including) 17.1.1
Discovery Timeline
- 2024-07-09 - CVE-2024-2177 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
- Reported through the HackerOne Report #2383443 and tracked in GitLab Issue #444467
Technical Details for CVE-2024-2177
Vulnerability Analysis
Cross Window Forgery, also referred to as tabnabbing or cross-window redressing, abuses the trust relationship between browser windows and tabs. In this GitLab case, an attacker crafts a page that interacts with a GitLab OAuth authorization window opened in a separate context. The attacker page manipulates navigation or UI state so the victim unknowingly approves an OAuth grant. Because the OAuth flow issues access tokens to the requesting client, a successful attack delivers the token to an attacker-controlled OAuth application.
The root issue is improper restriction of UI layering and cross-window references during the authorization step. GitLab did not sufficiently constrain how the OAuth consent window could be influenced from an opener or opened context.
Root Cause
The underlying weakness is [CWE-1021]: Improper Restriction of Rendered UI Layers or Frames. GitLab's OAuth authorization page allowed interaction patterns that let a malicious page influence what the user perceived or clicked. Missing browser-level protections such as strict X-Frame-Options, a restrictive Content-Security-Policyframe-ancestors directive, and controls on window.opener relationships enabled the forgery.
Attack Vector
The attack requires network access to a GitLab instance and user interaction. An attacker hosts a page that lures an authenticated GitLab user to click a control, opening or redirecting an OAuth authorization request to an attacker-registered OAuth client. The attacker-controlled page then manipulates the authorization window so the user approves the grant. The attacker receives the authorization code or token and uses it to access the victim's GitLab resources scoped to the requested OAuth permissions.
No verified public exploit code is available. Technical specifics are documented in the GitLab Issue #444467 and the HackerOne Report #2383443.
Detection Methods for CVE-2024-2177
Indicators of Compromise
- Unexpected OAuth application authorizations in a user's GitLab account settings under Applications → Authorized applications.
- OAuth access tokens issued to unfamiliar client IDs in GitLab audit events.
- API activity from new IP addresses or user agents using OAuth bearer tokens shortly after a user clicked an external link.
- Referrers to GitLab OAuth authorization endpoints (/oauth/authorize) originating from untrusted third-party domains.
Detection Strategies
- Review GitLab audit logs for authorized_application and user_impersonated events correlated with user sessions.
- Alert on OAuth grant creation events where the redirect_uri points to a domain outside an approved allowlist.
- Hunt for abnormal spikes in Personal Access Token or OAuth token issuance across the tenant.
Monitoring Recommendations
- Forward GitLab application and audit logs to a centralized analytics platform for correlation with web proxy and identity provider telemetry.
- Monitor outbound referrers and iframe embedding attempts targeting GitLab OAuth endpoints at the web gateway.
- Track newly registered OAuth applications on self-managed GitLab instances and require administrator approval before activation.
How to Mitigate CVE-2024-2177
Immediate Actions Required
- Upgrade self-managed GitLab CE/EE to version 16.11.5, 17.0.3, 17.1.1, or later.
- Audit and revoke any unrecognized authorized OAuth applications in the GitLab admin area and in individual user settings.
- Rotate OAuth client secrets and personal access tokens for accounts that may have interacted with suspicious authorization prompts.
Patch Information
GitLab addressed the issue in versions 16.11.5, 17.0.3, and 17.1.1. GitLab.com SaaS was patched by the vendor. Self-managed administrators must install the fixed version to remediate CVE-2024-2177. Reference the GitLab Issue #444467 for vendor remediation details.
Workarounds
- Restrict OAuth application registration to administrators only on self-managed instances until patched.
- Enforce an allowlist of trusted redirect_uri values for all OAuth applications.
- Require user re-authentication for every OAuth consent request to increase attacker friction.
- Educate users to avoid clicking OAuth prompts initiated from untrusted sites or unsolicited links.
# Example: upgrade a self-managed GitLab instance on Debian/Ubuntu
sudo apt-get update
sudo apt-get install gitlab-ee=17.1.1-ee.0
sudo gitlab-ctl reconfigure
sudo gitlab-rake gitlab:check SANITIZE=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
