CVE-2024-2191
📋 TL;DR
This vulnerability in GitLab allows unauthorized users to view merge request titles that were configured to be visible only to project members. It affects GitLab Community Edition (CE) and Enterprise Edition (EE) installations running vulnerable versions, potentially exposing sensitive project information.
💻 Affected Systems
- GitLab Community Edition
- GitLab Enterprise Edition
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
Sensitive project information, such as feature names, bug fixes, or internal project details, could be exposed to unauthorized users, leading to information disclosure that could aid targeted attacks.
Likely Case
Unauthorized users can see merge request titles that should be restricted, potentially revealing project roadmap details, security fixes, or internal development activities.
If Mitigated
With proper access controls and monitoring, the impact is limited to information disclosure of merge request titles only (not the full content), which may still be sensitive depending on the organization.
🎯 Exploit Status
Exploitation requires access to the GitLab instance but no authentication to view restricted merge request titles.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.11.5, 17.0.3, 17.1.1
Vendor Advisory: https://gitlab.com/gitlab-org/gitlab/-/issues/444655
Restart Required: Yes
Instructions:
1. Backup your GitLab instance. 2. Update GitLab to version 16.11.5, 17.0.3, or 17.1.1 depending on your current version. 3. Restart GitLab services.
🔧 Temporary Workarounds
Temporarily restrict merge request creation
allDisable merge request creation for projects with sensitive information until patched.
Navigate to Project Settings > General > Merge requests and adjust permissions
🧯 If You Can't Patch
- Review and audit merge request titles for sensitive information and sanitize if necessary.
- Implement network-level access controls to restrict GitLab access to authorized users only.
🔍 How to Verify
Check if Vulnerable:
Check GitLab version via Admin Area or run: sudo gitlab-rake gitlab:env:info | grep 'Version:'Check Version:
sudo gitlab-rake gitlab:env:info | grep 'Version:'Verify Fix Applied:
Verify version is 16.11.5, 17.0.3, or 17.1.1 after update and test that merge request titles with 'project members only' visibility are properly restricted.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to merge request endpoints by unauthorized users
Network Indicators:
- HTTP requests to /merge_requests endpoints from unauthorized IPs
SIEM Query:
source="gitlab" AND (uri_path="/merge_requests" OR uri_path="/api/v4/merge_requests") AND user_id="-1"