CVE-2024-4283: GitLab OAuth Auth Bypass Vulnerability

CVE-2024-4283 Overview

CVE-2024-4283 is an open redirect vulnerability [CWE-601] in GitLab Enterprise Edition (EE) that can lead to account takeover by breaking the OAuth authorization flow. The flaw affects all GitLab EE versions from 11.1 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under specific conditions, an attacker can redirect the OAuth callback to a domain they control and capture the authorization artifacts issued to the victim. Exploitation requires user interaction, such as clicking a crafted link, and is limited in scope by GitLab's OAuth handling.

Critical Impact
A successful attack breaks the OAuth flow and can result in full account takeover of the targeted GitLab user.

Affected Products

GitLab Enterprise Edition 11.1 through 17.1.6
GitLab Enterprise Edition 17.2 through 17.2.4
GitLab Enterprise Edition 17.3 through 17.3.1

Discovery Timeline

2024-09-16 - CVE-2024-4283 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4283

Vulnerability Analysis

The vulnerability is an open redirect that occurs within the GitLab OAuth authorization flow. GitLab EE fails to sufficiently validate a redirect target under certain conditions, allowing an attacker to steer the OAuth response toward an attacker-controlled destination. Because OAuth callbacks carry security-sensitive parameters such as authorization codes or tokens, redirecting the browser off the trusted GitLab origin exposes those artifacts to the attacker. The attacker can then exchange or replay the captured artifacts to authenticate as the victim, achieving account takeover.

Exploitation requires the victim to interact with a crafted URL, typically delivered via phishing, chat, or issue comments. The attack executes over the network and does not require prior authentication of the attacker. The scope changes because the impact crosses the trust boundary between the GitLab instance and the redirect destination.

Root Cause

The root cause is improper validation of a user-controllable redirect parameter used during OAuth processing. GitLab did not adequately restrict the target URL to trusted origins, permitting arbitrary external destinations under specific conditions. This is a classic instance of CWE-601, URL Redirection to Untrusted Site.

Attack Vector

An unauthenticated attacker crafts a GitLab OAuth authorization URL whose redirect target points to an attacker-controlled host. The attacker delivers this URL to an authenticated GitLab user. When the victim follows the link and completes the OAuth flow, GitLab redirects the response—including sensitive OAuth parameters—to the attacker's host. The attacker replays the captured material against GitLab to hijack the victim's session or account.

Refer to the GitLab Issue #458502 and the HackerOne Report #2474286 for additional technical context.

Detection Methods for CVE-2024-4283

Indicators of Compromise

OAuth authorization requests whose redirect_uri or downstream redirect parameters point to hosts outside the organization's approved domains.
Unexpected HTTP 302 responses from GitLab OAuth endpoints (/oauth/authorize, /users/auth/*/callback) sending users to external origins.
New or unfamiliar OAuth application grants appearing in user account settings.
Session logins from IP addresses or user agents that do not match the account's historical baseline shortly after an OAuth flow.

Detection Strategies

Parse GitLab production and access logs for OAuth endpoints and alert when redirect targets resolve to non-allowlisted domains.
Correlate authentication events with OAuth callback activity to identify sessions established immediately after an anomalous redirect.
Hunt for phishing lures containing GitLab OAuth URLs with encoded external redirect parameters in email and messaging telemetry.

Monitoring Recommendations

Enable GitLab audit events for authentication, OAuth grants, and personal access token creation, and forward them to a centralized SIEM.
Monitor for spikes in failed or unusual OAuth callbacks against the GitLab instance.
Track new OAuth application authorizations per user and alert on grants to unknown client IDs.

How to Mitigate CVE-2024-4283

Immediate Actions Required

Upgrade GitLab EE to 17.1.7, 17.2.5, 17.3.2, or a later patched release without delay.
Audit recent OAuth authorizations and revoke any grants or tokens that cannot be attributed to legitimate user activity.
Force reauthentication for users who may have interacted with suspicious GitLab links during the exposure window.

Patch Information

GitLab addressed CVE-2024-4283 in EE versions 17.1.7, 17.2.5, and 17.3.2. Administrators running any version from 11.1 up to these fix releases must upgrade. Details are tracked in GitLab Issue #458502.

Workarounds

Restrict OAuth application redirect_uri values in GitLab to an explicit allowlist of trusted callback URLs.
Enforce multi-factor authentication (MFA) for all GitLab users to raise the cost of a successful account takeover.
Educate users to inspect GitLab URLs before authenticating and to report suspicious login prompts.

bash

# Verify the installed GitLab version and confirm it is at or above the fixed release
sudo gitlab-rake gitlab:env:info | grep -i "GitLab information" -A 5

# Debian/Ubuntu upgrade example (replace with the appropriate fixed version)
sudo apt-get update && sudo apt-get install --only-upgrade gitlab-ee

# RHEL/CentOS upgrade example
sudo yum update gitlab-ee