CVE-2024-9773: GitLab Harbor Registry RCE Vulnerability

CVE-2024-9773 Overview

CVE-2024-9773 is a command injection vulnerability in GitLab Enterprise Edition (EE) affecting the Harbor container registry integration. The flaw stems from improper input validation (CWE-77) in code paths that render Command Line Interface (CLI) commands in the GitLab user interface. A project maintainer can inject malicious content into the CLI commands displayed to other users, leading to arbitrary command execution when a target user copies and runs the suggested command. The issue impacts GitLab EE versions from 14.9 up to the patched releases.

Critical Impact
An authenticated maintainer can inject malicious code into Harbor registry CLI commands rendered in the GitLab UI, resulting in arbitrary command execution against users who run the displayed commands.

Affected Products

GitLab EE versions 14.9 through versions prior to 17.8.6
GitLab EE versions 17.9 through versions prior to 17.9.3
GitLab EE versions 17.10 through versions prior to 17.10.1

Discovery Timeline

2025-03-27 - CVE-2024-9773 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9773

Vulnerability Analysis

GitLab EE integrates with Harbor, an open-source container registry, and surfaces CLI helper commands in the GitLab UI so developers can authenticate and interact with the registry. The vulnerability arises because user-controlled fields associated with the Harbor integration are not properly validated before being embedded into these CLI command strings. A project maintainer with permission to modify the Harbor integration configuration can supply crafted values that break out of the intended command context.

When another user views the affected project page and copies the rendered CLI command into a terminal, the injected payload executes on that user's host. The vulnerability is classified under CWE-77: Improper Neutralization of Special Elements used in a Command. Exploitation requires authenticated maintainer-level access to the project and user interaction from the victim, which is reflected in the CVSS vector.

Root Cause

The root cause is missing sanitization of configuration inputs used to build display strings. GitLab renders these values verbatim into shell-syntax command examples without escaping or validating shell metacharacters, allowing arbitrary command fragments to be appended to legitimate CLI invocations.

Attack Vector

The attack requires a maintainer role on the target project. The maintainer modifies the Harbor integration settings to include malicious shell content in fields that GitLab reflects into rendered CLI commands. A downstream user, typically a developer or operator, opens the project's Harbor integration view and copies the pre-formatted docker login or related command into a shell, triggering execution of the attacker-supplied code.

// No verified proof-of-concept code is publicly available.
// See the GitLab issue and HackerOne report referenced below for technical details.

Refer to GitLab Issue 498557 and HackerOne Report #2671808 for additional technical context.

Detection Methods for CVE-2024-9773

Indicators of Compromise

Unexpected modifications to Harbor integration settings on GitLab projects, particularly changes to URL, project name, or credential fields containing shell metacharacters such as ;, &&, |, or backticks.
Audit log entries showing maintainer accounts editing container registry integration configuration outside of normal change windows.
Endpoint telemetry showing shell processes spawned from clipboard-pasted docker or Harbor CLI commands that include unexpected additional binaries.

Detection Strategies

Review GitLab audit events for changes to integrations or Harbor configuration objects and correlate with the acting user's role and history.
Hunt across developer endpoints for anomalous child processes of interactive shells shortly after users access GitLab project pages tied to Harbor registries.
Inspect stored Harbor integration values in the GitLab database for shell metacharacters that would not appear in legitimate registry URLs or project identifiers.

Monitoring Recommendations

Enable and centralize GitLab audit logging for integration configuration changes and forward these events to a SIEM for correlation.
Alert on repeated integration edits by a single maintainer account across multiple projects within a short window.
Monitor endpoints of GitLab users for suspicious command execution patterns following browser activity on GitLab project pages.

How to Mitigate CVE-2024-9773

Immediate Actions Required

Upgrade GitLab EE to version 17.8.6, 17.9.3, or 17.10.1 or later, matching the branch currently deployed.
Audit Harbor integration configurations across all projects and remove any values containing shell metacharacters or unexpected content.
Review maintainer role assignments and revoke maintainer privileges from accounts that do not require them.

Patch Information

GitLab has released fixed builds in versions 17.8.6, 17.9.3, and 17.10.1 that add input validation to Harbor integration fields before they are rendered as CLI commands. Self-managed GitLab EE administrators should apply the patch corresponding to their release branch. GitLab.com is maintained by GitLab and is patched by the vendor. See GitLab Issue 498557 for the official reference.

Workarounds

Restrict the maintainer role to trusted personnel until patching is complete, since exploitation requires maintainer-level access.
Instruct developers not to copy CLI commands directly from the Harbor integration UI on unpatched instances and instead construct registry commands manually.
Where feasible, disable the Harbor registry integration on unpatched GitLab EE instances until the upgrade is applied.

bash

# Verify installed GitLab version on a self-managed instance
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Example upgrade command for Omnibus GitLab on Debian/Ubuntu
sudo apt-get update && sudo apt-get install gitlab-ee=17.10.1-ee.0