CVE-2024-8977 Overview
CVE-2024-8977 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting GitLab Enterprise Edition (EE). The flaw resides in the Product Analytics Dashboard component. It affects all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2.
Authenticated attackers with low privileges can coerce vulnerable GitLab instances into issuing arbitrary requests to internal or external systems. Only instances with the Product Analytics Dashboard configured and enabled are exposed to exploitation.
Critical Impact
Authenticated attackers can pivot through the GitLab server to reach internal services, cloud metadata endpoints, or otherwise unreachable network resources, compromising confidentiality and integrity.
Affected Products
- GitLab Enterprise Edition 15.10 through 17.2.8
- GitLab Enterprise Edition 17.3 through 17.3.4
- GitLab Enterprise Edition 17.4 through 17.4.1
Discovery Timeline
- 2024-10-10 - CVE-2024-8977 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8977
Vulnerability Analysis
CVE-2024-8977 is a Server-Side Request Forgery vulnerability in the Product Analytics Dashboard feature of GitLab EE. The dashboard accepts input that influences outbound HTTP requests made by the GitLab server. Insufficient validation of the destination allows an attacker to redirect those requests to arbitrary hosts.
SSRF vulnerabilities are particularly impactful in DevOps platforms because the affected server typically resides in trusted network segments. An attacker can query internal-only APIs, cloud provider metadata services such as 169.254.169.254, or lateral services not exposed to the internet. The vulnerability requires authentication but only low privileges, and no user interaction.
The issue is tracked as CWE-918: Server-Side Request Forgery and is limited to instances where the Product Analytics Dashboard is both configured and enabled.
Root Cause
The root cause is improper validation of user-controllable URL parameters processed by the Product Analytics Dashboard. The dashboard fetches remote resources based on configuration values without enforcing a strict allowlist of destinations or blocking access to internal address ranges.
Attack Vector
An authenticated attacker with access to a GitLab project supplies a malicious URL through the Product Analytics Dashboard configuration. The GitLab backend then performs an HTTP request to that URL from the server's network context. The attacker receives, either directly or through side channels, responses that would otherwise be inaccessible from the public internet.
For technical details, see the GitLab Issue Discussion and HackerOne Report #2697456.
Detection Methods for CVE-2024-8977
Indicators of Compromise
- Outbound HTTP requests from the GitLab application server to internal IP ranges (RFC1918) or link-local addresses such as 169.254.169.254.
- Product Analytics Dashboard configuration changes containing unusual or non-corporate URLs.
- Unexpected requests in GitLab application logs originating from the analytics pipeline targeting non-standard ports.
Detection Strategies
- Review GitLab production.log and application.log for analytics-related outbound requests to unexpected destinations.
- Inspect audit events for modifications to Product Analytics Dashboard configuration by low-privileged users.
- Correlate egress firewall logs with GitLab server source IPs to identify anomalous outbound connections.
Monitoring Recommendations
- Alert on any connection from the GitLab server to cloud metadata endpoints or internal management interfaces.
- Baseline expected outbound traffic from GitLab and flag deviations, particularly to non-HTTPS ports.
- Track Product Analytics Dashboard configuration changes and require review for URL fields.
How to Mitigate CVE-2024-8977
Immediate Actions Required
- Upgrade GitLab EE to version 17.2.9, 17.3.5, 17.4.2, or later depending on your release branch.
- If patching is not immediately possible, disable the Product Analytics Dashboard feature on affected instances.
- Audit recent Product Analytics Dashboard configuration changes for suspicious URLs.
Patch Information
GitLab has released fixes in versions 17.2.9, 17.3.5, and 17.4.2. Administrators should apply the latest patch release for their deployment branch. Reference the GitLab Issue Discussion for remediation guidance.
Workarounds
- Disable the Product Analytics Dashboard feature until the patch can be applied.
- Restrict egress network access from the GitLab application server to only required destinations using firewall rules.
- Block GitLab server access to cloud metadata endpoints such as 169.254.169.254 at the network layer.
- Enforce least privilege for GitLab users to reduce the population capable of configuring analytics dashboards.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
