CVE-2024-2434 Overview
CVE-2024-2434 is a path traversal vulnerability [CWE-22] affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw exists in all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1. An authenticated attacker can traverse directory paths to trigger denial-of-service conditions and read restricted files on the GitLab server. The vulnerability was disclosed through a HackerOne report and tracked in GitLab issue #450303.
Critical Impact
Authenticated attackers can exploit path traversal to read restricted files and cause denial-of-service on GitLab instances over the network with low attack complexity.
Affected Products
- GitLab CE/EE versions 16.9 prior to 16.9.6
- GitLab CE/EE versions 16.10 prior to 16.10.4
- GitLab CE/EE version 16.11 prior to 16.11.1
Discovery Timeline
- 2024-04-25 - CVE-2024-2434 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-2434
Vulnerability Analysis
The vulnerability is a path traversal weakness [CWE-22] in GitLab CE/EE. It allows an authenticated user with low privileges to submit crafted path components that escape intended directory boundaries. Successful exploitation leads to two impacts: reading files outside the permitted scope, and triggering denial-of-service conditions on the GitLab application. The issue affects both self-managed Community and Enterprise deployments across the 16.9, 16.10, and 16.11 release branches. Given the EPSS probability of 23.178% (97.576 percentile), this vulnerability sits in the top tier of CVEs by predicted exploitation likelihood.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory. GitLab code paths accept user-controlled input used to construct file paths without adequate normalization or validation of traversal sequences such as ../. Technical specifics are tracked in GitLab Issue #450303 and the associated HackerOne Report #2401952.
Attack Vector
The attack is delivered over the network against the GitLab web application. An attacker requires an authenticated low-privilege account. No user interaction is needed. Exploitation involves supplying crafted path input to affected endpoints, which the server resolves against sensitive locations. This yields disclosure of file contents and resource exhaustion conditions that degrade service availability.
No verified public proof-of-concept code is available. Refer to the vendor issue and HackerOne report linked above for technical details.
Detection Methods for CVE-2024-2434
Indicators of Compromise
- HTTP requests containing directory traversal sequences such as ../, ..%2f, or ..%252f in path parameters directed at GitLab endpoints.
- Unexpected file read errors, 500 responses, or elevated request latency in GitLab application logs.
- Sudden spikes in worker process CPU or memory consumption on GitLab Rails or Sidekiq nodes without corresponding legitimate workload.
Detection Strategies
- Inspect GitLab production.log and application.log for anomalous file-access errors and requests referencing paths outside standard repository or upload directories.
- Deploy web application firewall rules that flag encoded and double-encoded traversal sequences in requests to GitLab API and web routes.
- Correlate authenticated user activity with unusual file-read patterns or repeated 4xx/5xx responses tied to a single session.
Monitoring Recommendations
- Forward GitLab NGINX, Rails, and Workhorse logs to a centralized SIEM for retention and query.
- Alert on request rates from a single authenticated identity that exceed baselines for endpoints handling file paths.
- Track availability metrics on GitLab worker pools to detect denial-of-service symptoms early.
How to Mitigate CVE-2024-2434
Immediate Actions Required
- Upgrade GitLab CE/EE to version 16.9.6, 16.10.4, or 16.11.1 or later, matching your current release branch.
- Audit authenticated user accounts and rotate credentials for any accounts showing anomalous file-access activity.
- Review access logs for the period preceding the patch to identify potential exploitation attempts.
Patch Information
GitLab released fixed versions 16.9.6, 16.10.4, and 16.11.1 that address the path traversal condition. Self-managed administrators should follow GitLab's standard upgrade procedure and verify version reporting through the admin interface after upgrade. See GitLab Issue #450303 for tracking details.
Workarounds
- No official vendor workaround is published; upgrading remains the required remediation.
- Restrict network exposure of GitLab instances to trusted networks and enforce strong authentication to reduce the attacker pool.
- Apply WAF rules that block traversal payloads in path and query parameters as a compensating control until patching completes.
# Verify installed GitLab version after upgrade
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5
# Omnibus upgrade example (Debian/Ubuntu) to a fixed release
sudo apt-get update && sudo apt-get install gitlab-ee=16.11.1-ee.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
