CVE-2024-3127
📋 TL;DR
This vulnerability allows unauthorized users to bypass IP restrictions for GitLab groups via GraphQL, potentially performing unauthorized group-level actions. It affects GitLab EE versions 12.5 through 17.1.5, 17.2 through 17.2.3, and 17.3 through 17.3.0.
💻 Affected Systems
- GitLab EE
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users could modify group settings, access sensitive group data, or perform administrative actions they shouldn't have access to.
Likely Case
Limited unauthorized access to group-level features that should be restricted by IP, potentially exposing some group metadata or configuration.
If Mitigated
With proper network segmentation and additional authentication layers, impact would be minimal even if exploited.
🎯 Exploit Status
Requires knowledge of GraphQL endpoints and understanding of group structure. Attacker needs some level of access to the GitLab instance.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 17.1.6, 17.2.4, 17.3.1
Vendor Advisory: https://gitlab.com/gitlab-org/gitlab/-/issues/452640
Restart Required: Yes
Instructions:
1. Backup your GitLab instance. 2. Update to GitLab EE version 17.1.6, 17.2.4, or 17.3.1 depending on your current version track. 3. Restart GitLab services.
🔧 Temporary Workarounds
Disable GraphQL for IP-restricted groups
allTemporarily disable GraphQL access or restrict it further for groups with IP restrictions
Strengthen network controls
allImplement additional network-level restrictions for GitLab GraphQL endpoints
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules for GitLab GraphQL endpoints
- Add additional authentication/authorization layers for group-level operations
🔍 How to Verify
Check if Vulnerable:
Check GitLab version: if running EE version between 12.5-17.1.5, 17.2-17.2.3, or 17.3-17.3.0, you are vulnerable.Check Version:
sudo gitlab-rake gitlab:env:info | grep 'Version:'Verify Fix Applied:
Verify GitLab version is 17.1.6, 17.2.4, or 17.3.1 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Unusual GraphQL requests to group endpoints from unauthorized IPs
- Failed IP restriction logs followed by successful group operations
Network Indicators:
- GraphQL requests to /api/graphql endpoint from unexpected sources
SIEM Query:
source="gitlab" AND ("GraphQL" OR "/api/graphql") AND ("group" OR "unauthorized" OR "IP restriction")