CVE-2024-9163: GitLab Auth Bypass Vulnerability

CVE-2024-9163 Overview

CVE-2024-9163 is a business logic flaw in GitLab Community Edition (CE) and Enterprise Edition (EE) that allows an attacker to cause branch name confusion within confidential merge requests (MRs). The issue affects all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3, and 18.0 prior to 18.0.1. The weakness maps to CWE-451 (User Interface Misrepresentation of Critical Information). An unauthenticated, network-based attacker can exploit the flaw to compromise the confidentiality of information tied to confidential MRs.

Critical Impact
Attackers can induce branch name confusion in confidential merge requests, undermining the visual trust boundary GitLab uses to protect sensitive code changes and potentially exposing confidential information.

Affected Products

GitLab CE/EE versions 12.1 through versions prior to 17.10.7
GitLab CE/EE 17.11 prior to 17.11.3
GitLab CE/EE 18.0 prior to 18.0.1

Discovery Timeline

2025-05-23 - CVE-2024-9163 published to NVD
2025-08-08 - Last updated in NVD database

Technical Details for CVE-2024-9163

Vulnerability Analysis

The vulnerability is a business logic error in GitLab's handling of branch names associated with confidential merge requests. GitLab uses confidential MRs to keep security-sensitive changes private until they are ready for disclosure. The flaw allows an attacker to craft branch names that visually or logically collide with legitimate branches, producing user interface misrepresentation as classified under [CWE-451]. This confusion can be leveraged to mislead reviewers or extract information that should remain restricted to authorized maintainers. The attack vector is network-based, requires no privileges, and needs no user interaction, but only confidentiality is affected — integrity and availability remain intact.

Root Cause

The root cause is GitLab's permissive treatment of branch name uniqueness and presentation logic in the confidential MR workflow. The application does not adequately distinguish or normalize branch identifiers in contexts where confidentiality boundaries are enforced. As a result, the system surfaces ambiguous branch references that can be conflated by users or downstream automation.

Attack Vector

An unauthenticated remote attacker interacts with the GitLab instance over the network to create or reference a branch whose name collides with one used inside a confidential MR. When GitLab renders MR metadata, links, or pipeline references, the confusion can lead to disclosure of information that should be restricted to the confidential MR's audience. Further technical detail is published in the GitLab Issue Report and the corresponding HackerOne Security Report.

No verified public proof-of-concept code is available. Refer to the linked advisories for reproduction details.

Detection Methods for CVE-2024-9163

Indicators of Compromise

Branch names within a project that closely mirror or duplicate names used in confidential merge requests, including names with Unicode lookalikes or trailing whitespace.
Unexpected fork or push activity from low-privilege or external accounts targeting repositories that host confidential MRs.
Access patterns where unauthenticated or unauthorized users repeatedly request MR or branch metadata endpoints.

Detection Strategies

Audit GitLab project branches for naming collisions with branches referenced in confidential MRs, focusing on visually similar identifiers.
Review GitLab audit events and production_json.log for branch creation, MR view, and pipeline trigger activity correlated with confidential MR IDs.
Correlate web request logs for the /api/v4/projects/:id/merge_requests and /api/v4/projects/:id/repository/branches endpoints to surface enumeration behavior.

Monitoring Recommendations

Forward GitLab application, audit, and webserver logs to a centralized analytics platform and alert on anomalous branch creation rates per user.
Monitor for branch names containing non-ASCII characters, homoglyphs, or names that case-insensitively match protected branches.
Track confidential MR access events and flag views originating from accounts that are not members of the MR's approver group.

How to Mitigate CVE-2024-9163

Immediate Actions Required

Upgrade self-managed GitLab to 17.10.7, 17.11.3, or 18.0.1 or later, depending on your release branch.
Inventory all confidential merge requests and review their associated branches for naming collisions introduced before the upgrade.
Restrict project membership and branch creation permissions on repositories that host confidential MRs.

Patch Information

GitLab has released fixed versions 17.10.7, 17.11.3, and 18.0.1. GitLab.com SaaS instances are patched by the vendor. Self-managed administrators should apply the upgrade using the standard GitLab upgrade procedure and verify the running version with gitlab-rake gitlab:env:info. See the GitLab Issue Report for the full advisory.

Workarounds

Limit who can create branches and push to repositories containing confidential MRs by enforcing protected branch rules and tightening project access levels.
Require maintainer review of branch names referenced by any confidential MR before merge or pipeline execution.
Disable public access to projects that contain confidential MRs until the patched version is deployed.

bash

# Verify your GitLab version and upgrade to a fixed release
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Debian/Ubuntu upgrade example to a fixed version
sudo apt-get update
sudo apt-get install gitlab-ee=18.0.1-ee.0

# Restart and verify
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart