CVE-2024-7110
📋 TL;DR
This CVE allows attackers to execute arbitrary commands in GitLab CI/CD pipelines through prompt injection. Attackers can manipulate pipeline configurations to run malicious code on GitLab runners. All GitLab EE instances running affected versions are vulnerable.
💻 Affected Systems
- GitLab EE
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
Full compromise of GitLab runners leading to data exfiltration, lateral movement, and deployment of malicious code to production environments.
Likely Case
Unauthorized code execution in CI/CD pipelines leading to credential theft, repository compromise, and supply chain attacks.
If Mitigated
Limited impact with proper runner isolation, network segmentation, and pipeline validation controls.
🎯 Exploit Status
Requires ability to create or modify pipeline configurations. Likely requires authenticated access to GitLab.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 17.1.7, 17.2.4, 17.3.1 or later
Vendor Advisory: https://gitlab.com/gitlab-org/gitlab/-/issues/472603
Restart Required: Yes
Instructions:
1. Backup GitLab instance. 2. Update to patched version using GitLab's update process. 3. Restart GitLab services. 4. Verify pipeline functionality.
🔧 Temporary Workarounds
Restrict pipeline creation
allLimit who can create or modify CI/CD pipelines to trusted users only
Runner isolation
allConfigure GitLab runners with minimal permissions and network isolation
🧯 If You Can't Patch
- Implement strict access controls on pipeline configuration files (.gitlab-ci.yml)
- Enable pipeline security scanning and validation before execution
🔍 How to Verify
Check if Vulnerable:
Check GitLab version via Admin Area or command: sudo gitlab-rake gitlab:env:infoCheck Version:
sudo gitlab-rake gitlab:env:info | grep 'GitLab Version'Verify Fix Applied:
Confirm version is 17.1.7+, 17.2.4+, or 17.3.1+ and test pipeline execution📡 Detection & Monitoring
Log Indicators:
- Unusual pipeline executions
- Suspicious commands in CI/CD logs
- Multiple pipeline failures with command injection patterns
Network Indicators:
- Unexpected outbound connections from GitLab runners
- Unusual data transfers during pipeline execution
SIEM Query:
source="gitlab" AND ("pipeline" OR "runner") AND ("exec" OR "inject" OR "malicious")