CVE-2024-6324
📋 TL;DR
A denial-of-service vulnerability in GitLab allows attackers to create cyclic references between epics, causing resource exhaustion and service disruption. This affects all GitLab CE/EE instances running vulnerable versions. Both authenticated users with appropriate permissions and potentially unauthenticated attackers could exploit this.
💻 Affected Systems
- GitLab Community Edition
- GitLab Enterprise Edition
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion, affecting all GitLab functionality including repositories, CI/CD pipelines, and user management.
Likely Case
Degraded performance or temporary service disruption affecting epic management functionality, potentially impacting project planning workflows.
If Mitigated
Minimal impact with proper rate limiting, resource monitoring, and access controls in place to prevent malicious epic creation.
🎯 Exploit Status
Exploitation requires authenticated access with permissions to create/modify epics. The technique is straightforward once understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 17.5.5, 17.6.3, or 17.7.1
Vendor Advisory: https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#cyclic-reference-of-epics-leads-resource-exhaustion
Restart Required: Yes
Instructions:
1. Backup your GitLab instance. 2. Update to patched version using your deployment method (Omnibus, Helm, source). 3. Restart GitLab services. 4. Verify update with version check command.
🔧 Temporary Workarounds
Restrict Epic Creation Permissions
allTemporarily limit who can create or modify epics to trusted users only
Implement Rate Limiting
linuxConfigure rate limits on API endpoints related to epic creation/modification
Edit /etc/gitlab/gitlab.rb and set appropriate rate limits, then run 'gitlab-ctl reconfigure'
🧯 If You Can't Patch
- Implement strict access controls on epic management features
- Monitor system resources and set up alerts for unusual epic creation patterns
🔍 How to Verify
Check if Vulnerable:
Check GitLab version against affected ranges. For Omnibus: 'sudo gitlab-rake gitlab:env:info | grep Version'Check Version:
sudo gitlab-rake gitlab:env:info | grep VersionVerify Fix Applied:
Confirm version is 17.5.5, 17.6.3, 17.7.1 or higher. Test epic creation functionality works normally.📡 Detection & Monitoring
Log Indicators:
- Unusual number of epic creation/modification requests
- Resource exhaustion warnings in application logs
- Error logs related to epic processing
Network Indicators:
- Spike in API requests to /api/v4/groups/*/epics endpoints
- Increased resource utilization without corresponding user activity
SIEM Query:
source="gitlab" AND ("epic" AND ("create" OR "update")) | stats count by src_ip, user