CVE-2024-8970: GitLab Authentication Bypass Vulnerability

CVE-2024-8970 Overview

CVE-2024-8970 is an authorization flaw [CWE-863] in GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerability allows an authenticated attacker to trigger a pipeline as another user under specific conditions. It affects all versions from 11.6 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. GitLab patched the issue across the 17.2.x, 17.3.x, and 17.4.x maintenance branches.

Critical Impact
An attacker with low privileges can execute CI/CD pipelines under another user's identity, leading to confidentiality, integrity, and availability impact across protected branches, environments, and secrets.

Affected Products

GitLab CE/EE versions 11.6 up to and including 17.2.8
GitLab CE/EE versions 17.3 up to and including 17.3.4
GitLab CE/EE versions 17.4 up to and including 17.4.1

Discovery Timeline

2024-10-11 - CVE-2024-8970 published to the National Vulnerability Database
2024-12-13 - Last updated in NVD database

Technical Details for CVE-2024-8970

Vulnerability Analysis

The vulnerability is an improper authorization issue [CWE-863] in GitLab's pipeline execution logic. An attacker authenticated to a GitLab instance can craft a request that triggers a CI/CD pipeline run executed under a different user's identity. Pipelines inherit the impersonated user's permissions, project memberships, protected branch access, and CI/CD variables. This breaks the trust boundary between pipeline initiator and pipeline runtime context.

GitLab pipelines frequently hold sensitive secrets, deploy keys, and tokens scoped to the executing user. Running a pipeline as another user can therefore expose protected variables, push code to protected branches, and reach restricted deployment environments. The attack requires only low privileges and no user interaction, with a network-reachable GitLab instance as the entry point.

Root Cause

The root cause is an authorization check failure in the pipeline trigger workflow. GitLab did not consistently validate that the requesting user was authorized to act as the target user when initiating pipeline execution. This is a logic-level access control defect rather than a memory safety or injection class issue.

Attack Vector

The attack is performed over the network against the GitLab API or web interface. An attacker with a valid GitLab account submits a crafted pipeline trigger request. Under the affected conditions, the request results in pipeline execution attributed to and authorized as another user. Refer to the GitLab Issue Report and the HackerOne Security Report for additional technical context.

Detection Methods for CVE-2024-8970

Indicators of Compromise

Pipeline records where the triggering user differs from the user account that owns the associated commit, merge request, or schedule.
Unexpected pipeline runs executing against protected branches or protected environments outside normal CI/CD activity windows.
Access or use of CI/CD variables, deploy tokens, or job artifacts by pipelines that did not previously interact with those resources.

Detection Strategies

Audit the GitLab audit_events and ci_pipelines tables for mismatches between pipeline user_id and the user identity associated with the trigger source.
Correlate GitLab API access logs with pipeline creation events to identify trigger requests issued by users who lack direct pipeline permissions on the target project.
Review job logs and runner activity for unexpected secret access or commits to protected refs originating from CI jobs.

Monitoring Recommendations

Forward GitLab audit and application logs to a centralized analytics platform and alert on pipelines triggered by users without project membership.
Track baseline pipeline frequency per project and user, and alert on statistical anomalies after applying the patch.
Monitor outbound network activity from GitLab runners for unexpected destinations that may indicate misuse of stolen secrets.

How to Mitigate CVE-2024-8970

Immediate Actions Required

Upgrade GitLab CE/EE to version 17.2.9, 17.3.5, or 17.4.2 or later depending on your release branch.
Rotate CI/CD variables, deploy tokens, runner registration tokens, and personal access tokens that may have been exposed through pipeline runs.
Review recent pipeline executions for unauthorized activity, especially on protected branches and production environments.

Patch Information

GitLab released fixed versions 17.2.9, 17.3.5, and 17.4.2 that contain the authorization fix. Self-managed administrators should apply the patch through their normal package or container update process. GitLab.com SaaS tenants have already been updated by GitLab.

Workarounds

No vendor-supplied workaround replaces patching; restrict pipeline trigger permissions and protected branch access to the minimum required user set until upgrade is complete.
Disable or scope CI/CD variables marked as protected to specific environments to limit blast radius.
Require approval rules for deployments to production environments to add a human check on pipeline-driven changes.

bash

# Configuration example: upgrade GitLab on Debian/Ubuntu to a patched release
sudo apt-get update
sudo apt-get install gitlab-ee=17.4.2-ee.0
sudo gitlab-ctl reconfigure
sudo gitlab-rake gitlab:check SANITIZE=true