CVE-2024-9164: GitLab EE Pipeline RCE Vulnerability

CVE-2024-9164 Overview

A critical authorization bypass vulnerability has been discovered in GitLab Enterprise Edition (EE) that allows authenticated attackers to run CI/CD pipelines on arbitrary branches. This security flaw affects GitLab EE installations across a wide range of versions, potentially enabling unauthorized code execution and deployment through the pipeline system.

The vulnerability stems from missing authentication controls (CWE-306) in the pipeline execution functionality, allowing attackers with low-privilege access to trigger pipelines on branches they should not have access to. This could lead to unauthorized code deployment, data exfiltration, or supply chain attacks through compromised CI/CD workflows.

Critical Impact

Authenticated attackers can execute CI/CD pipelines on arbitrary branches, potentially enabling unauthorized code deployment, credential theft from pipeline secrets, and supply chain compromise.

Affected Products

• GitLab Enterprise Edition versions 12.5 prior to 17.2.9
• GitLab Enterprise Edition versions 17.3 prior to 17.3.5
• GitLab Enterprise Edition versions 17.4 prior to 17.4.2

Discovery Timeline

• 2024-10-11 - CVE-2024-9164 published to NVD
• 2024-12-13 - Last updated in NVD database

Technical Details for CVE-2024-9164

Vulnerability Analysis

This vulnerability represents a missing authentication for critical function flaw (CWE-306) in GitLab's pipeline execution system. The vulnerability allows authenticated users to bypass branch-level access controls and trigger CI/CD pipelines on branches they should not have permission to access.

In GitLab's architecture, CI/CD pipelines are a powerful feature that can execute arbitrary code, access secrets and credentials, deploy to production environments, and interact with external services. The ability to run pipelines on arbitrary branches creates significant security implications, as attackers could potentially trigger pipelines containing malicious code or access secrets configured for protected branches.

The attack is network-accessible and requires only low-privilege authentication, with no user interaction needed. Successful exploitation can result in high impact to confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of this vulnerability is missing authentication checks in GitLab's pipeline execution functionality. The application fails to properly validate whether the requesting user has appropriate permissions to trigger pipelines on the specified branch. This missing authorization check allows authenticated users to bypass the intended branch protection mechanisms and execute pipelines regardless of their actual access level.

Attack Vector

The vulnerability is exploitable over the network by authenticated users with minimal privileges. An attacker with a valid GitLab account on the target instance can craft requests to trigger pipeline execution on branches they would not normally have access to, including protected branches that may contain sensitive configurations or secrets.

The attack flow involves:

1. Attacker authenticates to GitLab EE with a low-privilege account
2. Attacker identifies target branches (including protected branches)
3. Attacker triggers pipeline execution on arbitrary branches by bypassing access controls
4. Pipelines execute with the permissions and secrets configured for those branches

For detailed technical information about the exploitation mechanism, refer to the HackerOne Report #2711204 and the GitLab Issue Discussion.

Detection Methods for CVE-2024-9164

Indicators of Compromise

• Unexpected pipeline executions on protected or sensitive branches by unauthorized users
• Audit logs showing pipeline triggers from users without branch access permissions
• Unusual patterns of pipeline executions across multiple branches from single accounts
• Pipeline jobs accessing secrets or deploying to environments outside normal user scope

Detection Strategies

• Monitor GitLab audit logs for pipeline creation events, correlating user permissions with branch access
• Implement alerting for pipeline executions on protected branches by users without explicit access
• Review CI/CD job logs for unexpected access patterns or secret retrieval attempts
• Deploy SentinelOne Singularity for endpoint detection of anomalous GitLab Runner activity

Monitoring Recommendations

• Enable comprehensive audit logging in GitLab for all pipeline-related events
• Configure alerts for pipeline triggers on production or protected branches
• Monitor for unusual patterns in CI/CD execution frequency and branch targeting
• Review access patterns for service accounts and API tokens used in CI/CD workflows

How to Mitigate CVE-2024-9164

Immediate Actions Required

• Upgrade GitLab EE to version 17.2.9, 17.3.5, or 17.4.2 or later immediately
• Review recent pipeline execution logs for signs of exploitation
• Audit branch protection rules and ensure they are properly configured
• Rotate any secrets or credentials that may have been exposed through unauthorized pipeline executions

Patch Information

GitLab has released patched versions addressing this vulnerability. Organizations should upgrade to the following minimum versions:

• Version 17.2.9 for the 17.2.x branch
• Version 17.3.5 for the 17.3.x branch
• Version 17.4.2 for the 17.4.x branch

Refer to the GitLab Issue Discussion for official patch details and upgrade guidance.

Workarounds

• Implement strict network segmentation to limit GitLab access to trusted networks only
• Review and minimize the number of users with any level of GitLab access
• Temporarily disable CI/CD functionality for sensitive repositories until patching is complete
• Implement additional monitoring and alerting on pipeline execution events
• Consider using IP allowlists to restrict access to the GitLab instance

# Configuration example - Review and export pipeline audit logs for analysis
# Check for unauthorized pipeline executions in GitLab
gitlab-rake gitlab:audit_events:export SINCE="2024-10-01" | grep -E "pipeline|ci_build"

# Verify current GitLab version
gitlab-rake gitlab:env:info | grep "GitLab version"

# Check protected branch configurations
gitlab-rails runner "Project.find_each { |p| puts \"#{p.name}: #{p.protected_branches.pluck(:name)}\" }"