CVE-2024-3035
📋 TL;DR
A permission check vulnerability in GitLab CE/EE allows LFS (Large File Storage) tokens to read and write to user-owned repositories without proper authorization. This affects all GitLab instances running vulnerable versions, potentially exposing sensitive repository data.
💻 Affected Systems
- GitLab Community Edition
- GitLab Enterprise Edition
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
Attackers with LFS tokens could exfiltrate or modify sensitive source code, credentials, or intellectual property from any user repository, leading to data breaches or supply chain attacks.
Likely Case
Unauthorized access to repository contents, allowing reading of private code, configuration files, or secrets stored in repositories.
If Mitigated
Limited impact if repositories contain only public data or if LFS tokens are strictly controlled and monitored.
🎯 Exploit Status
Exploitation requires possession of LFS tokens, which are typically obtained through legitimate access or other compromises.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 17.0.6, 17.1.4, or 17.2.2
Vendor Advisory: https://gitlab.com/gitlab-org/gitlab/-/issues/452297
Restart Required: Yes
Instructions:
1. Backup your GitLab instance. 2. Update to GitLab 17.0.6, 17.1.4, or 17.2.2 using your package manager. 3. Restart GitLab services. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable LFS functionality
allTemporarily disable Git LFS to prevent exploitation while planning patching.
git config --global lfs.allowincompletepush false
Disable LFS in GitLab admin settings if available
🧯 If You Can't Patch
- Restrict LFS token creation and usage to minimal necessary users
- Implement network segmentation to limit access to GitLab instances from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check GitLab version via admin panel or command: sudo gitlab-rake gitlab:env:info | grep 'Version:'Check Version:
sudo gitlab-rake gitlab:env:info | grep 'Version:'Verify Fix Applied:
Confirm version is 17.0.6, 17.1.4, 17.2.2 or later. Test LFS token permissions in a controlled repository.📡 Detection & Monitoring
Log Indicators:
- Unusual LFS token usage patterns
- Repository access from unexpected IPs or users via LFS
Network Indicators:
- Abnormal LFS protocol traffic to repositories
SIEM Query:
source="gitlab" AND (lfs_token OR lfs_access) AND action="repository_access"