CVE-2024-8635
📋 TL;DR
A server-side request forgery (SSRF) vulnerability in GitLab EE allows attackers to make requests to internal resources via a custom Maven Dependency Proxy URL. This affects all GitLab EE installations running vulnerable versions. Attackers could potentially access internal services that should not be exposed.
💻 Affected Systems
- GitLab EE
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
Attacker accesses sensitive internal systems, exfiltrates data, or performs lateral movement within the network.
Likely Case
Attacker probes internal network, discovers internal services, or accesses limited internal resources.
If Mitigated
Limited impact due to network segmentation, firewall rules, or lack of valuable internal targets.
🎯 Exploit Status
Requires authenticated access to GitLab. Exploitation involves manipulating Maven Dependency Proxy URLs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 17.1.7, 17.2.5, or 17.3.2
Vendor Advisory: https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
Restart Required: Yes
Instructions:
1. Backup GitLab instance. 2. Update to patched version via package manager (apt/yum). 3. Run 'gitlab-ctl reconfigure'. 4. Restart GitLab services.
🔧 Temporary Workarounds
Disable Maven Dependency Proxy
linuxTemporarily disable the vulnerable feature until patching
gitlab-rails runner "ApplicationSetting.current.update!(maven_dependency_proxy_enabled: false)"
🧯 If You Can't Patch
- Restrict network access to GitLab instance using firewall rules
- Implement network segmentation to limit GitLab's access to internal resources
🔍 How to Verify
Check if Vulnerable:
Check GitLab version via admin panel or command: cat /opt/gitlab/version-manifest.txtCheck Version:
sudo gitlab-rake gitlab:env:info | grep 'GitLab version'Verify Fix Applied:
Confirm version is 17.1.7, 17.2.5, or 17.3.2 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual Maven Dependency Proxy requests
- Requests to internal IPs from GitLab
Network Indicators:
- GitLab server making unexpected outbound connections to internal services
SIEM Query:
source="gitlab" AND "maven" AND "dependency" AND "proxy"