CVE-2024-4994 Overview
CVE-2024-4994 is a Cross-Site Request Forgery (CSRF) vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw resides in GitLab's GraphQL API and allows attackers to execute arbitrary GraphQL mutations on behalf of authenticated victims. The vulnerability impacts all versions from 16.1.0 before 16.11.5, 17.0 before 17.0.3, and 17.1.0 before 17.1.1. The weakness is tracked under CWE-352 and requires user interaction to trigger.
Critical Impact
Successful exploitation allows attackers to perform arbitrary GraphQL mutations in the context of an authenticated GitLab user, potentially modifying repositories, projects, and account configurations.
Affected Products
- GitLab Community Edition (CE) versions 16.1.0 through 16.11.4
- GitLab Enterprise Edition (EE) versions 17.0 through 17.0.2
- GitLab CE/EE versions 17.1.0
Discovery Timeline
- 2025-06-20 - CVE-2024-4994 published to NVD
- 2025-08-12 - Last updated in NVD database
Technical Details for CVE-2024-4994
Vulnerability Analysis
The vulnerability stems from insufficient CSRF protections on GitLab's GraphQL API endpoint. GraphQL mutations are state-changing operations equivalent to HTTP POST actions in REST APIs. GitLab's implementation failed to adequately validate the origin of mutation requests sent to the GraphQL endpoint.
Attackers can craft malicious web pages that submit cross-origin requests carrying GraphQL mutation payloads. When an authenticated GitLab user visits such a page, the browser automatically includes the user's session cookies. The GraphQL endpoint then processes the mutation as if the user intentionally submitted it.
The attack requires user interaction, typically through phishing or social engineering to lure the victim to an attacker-controlled page. Network-based exploitation is possible without prior authentication on the attacker's side, since the victim's authenticated session supplies the necessary credentials.
Root Cause
The root cause is improper enforcement of anti-CSRF tokens or SameSite cookie controls on GraphQL mutation requests. Standard CSRF defenses validate a per-session token or restrict cross-origin credential transmission. GitLab's GraphQL implementation accepted mutation requests without sufficient origin verification, allowing forged requests to succeed.
Attack Vector
The attack vector is network-based and exploits browser-driven request forwarding. An attacker hosts a malicious page containing JavaScript or an HTML form targeting /api/graphql on the victim's GitLab instance. The payload contains a GraphQL mutation such as adding an SSH key, modifying project settings, or creating access tokens.
When the authenticated victim loads the attacker's page, the browser transmits the forged request with valid session cookies. The GitLab server processes the mutation under the victim's identity. See the HackerOne Security Report #2473644 and the GitLab Issue Discussion for technical details.
Detection Methods for CVE-2024-4994
Indicators of Compromise
- Unexpected GraphQL mutation requests in GitLab application logs originating from external Referer or Origin headers
- Creation of new SSH keys, personal access tokens, or deploy keys without corresponding user-initiated UI sessions
- Project or repository configuration changes that do not align with normal user activity patterns
- Authenticated POST requests to /api/graphql lacking the expected CSRF token header
Detection Strategies
- Audit GitLab's production_json.log and api_json.log for GraphQL mutation calls with anomalous Referer or Origin values
- Correlate GraphQL mutation timestamps with user browser activity to identify unattended state changes
- Deploy web application firewall rules that flag cross-origin POST requests to /api/graphql
Monitoring Recommendations
- Forward GitLab application and audit logs to a centralized SIEM for retention and correlation
- Alert on creation of personal access tokens, SSH keys, or deploy keys outside maintenance windows
- Monitor for sudden changes in project membership, visibility, or protected branch settings
- Track outbound notifications sent to users about account changes they did not initiate
How to Mitigate CVE-2024-4994
Immediate Actions Required
- Upgrade GitLab CE/EE to version 16.11.5, 17.0.3, or 17.1.1 or later depending on your release branch
- Review audit logs for suspicious GraphQL mutations since deploying the affected versions
- Rotate personal access tokens, SSH keys, and deploy keys if unauthorized creation is suspected
- Notify GitLab users to avoid clicking untrusted links while logged into the GitLab instance
Patch Information
GitLab released fixed versions 16.11.5, 17.0.3, and 17.1.1 that enforce CSRF protections on GraphQL mutations. Administrators running self-managed GitLab instances should apply the patches following the official upgrade procedure. GitLab.com SaaS instances are already patched by the vendor. Refer to the GitLab Issue Discussion for additional remediation context.
Workarounds
- Enforce strict SameSite=Lax or SameSite=Strict cookie policies on session cookies at the reverse proxy layer where possible
- Restrict access to the GitLab web interface using network segmentation or VPN to reduce exposure to drive-by CSRF attacks
- Train users to log out of GitLab sessions when browsing untrusted websites
# Verify installed GitLab version after upgrade
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5
# Example apt upgrade for Debian/Ubuntu self-managed instances
sudo apt-get update
sudo apt-get install gitlab-ee=17.1.1-ee.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
