CVE-2024-11274
📋 TL;DR
This vulnerability allows attackers to inject NEL (Network Error Logging) headers into Kubernetes proxy responses in GitLab, potentially leading to session data exfiltration. All GitLab CE/EE instances running affected versions are vulnerable, particularly those using Kubernetes integration.
💻 Affected Systems
- GitLab Community Edition
- GitLab Enterprise Edition
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
Attackers could exfiltrate sensitive session data including authentication tokens, potentially leading to account takeover, data breaches, and lateral movement within the GitLab environment.
Likely Case
Session hijacking and unauthorized access to GitLab repositories, pipelines, and sensitive project data.
If Mitigated
Limited impact with proper network segmentation and monitoring, though session data could still be exposed.
🎯 Exploit Status
Exploitation requires access to inject headers into k8s proxy responses, likely requiring some level of access to the GitLab environment.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 17.4.6, 17.5.4, 17.6.2
Vendor Advisory: https://gitlab.com/gitlab-org/gitlab/-/issues/504707
Restart Required: Yes
Instructions:
1. Backup GitLab instance. 2. Update to patched version using package manager (apt/yum) or Omnibus. 3. Restart GitLab services. 4. Verify update with gitlab-rake gitlab:env:info.
🔧 Temporary Workarounds
Disable Kubernetes Integration
linuxTemporarily disable GitLab Kubernetes agent server if not essential.
gitlab-rake gitlab:kubernetes:agent:disable
Restrict Network Access
linuxLimit network access to GitLab Kubernetes proxy endpoints.
iptables -A INPUT -p tcp --dport 8150 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate GitLab Kubernetes components
- Enable enhanced logging and monitoring for suspicious header injection attempts
🔍 How to Verify
Check if Vulnerable:
Check GitLab version with: sudo gitlab-rake gitlab:env:info | grep 'GitLab version'Check Version:
sudo gitlab-rake gitlab:env:info | grep 'GitLab version'Verify Fix Applied:
Confirm version is 17.4.6+, 17.5.4+, or 17.6.2+ and test Kubernetes proxy functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual NEL header patterns in GitLab logs
- Suspicious requests to /api/v4/internal/kubernetes endpoints
Network Indicators:
- Unexpected outbound connections from GitLab to external domains following k8s proxy requests
SIEM Query:
source="gitlab" AND ("NEL" OR "kubernetes/agent" OR "session" AND "exfiltrat*")