CVE-2024-9367
📋 TL;DR
This vulnerability in GitLab CE/EE allows attackers to cause uncontrolled CPU consumption by exploiting template parsing during changelog generation, potentially leading to Denial of Service (DoS). It affects all GitLab instances running vulnerable versions, potentially disrupting service availability.
💻 Affected Systems
- GitLab Community Edition (CE)
- GitLab Enterprise Edition (EE)
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, preventing legitimate users from accessing GitLab services.
Likely Case
Performance degradation and intermittent service disruptions affecting repository operations and CI/CD pipelines.
If Mitigated
Minimal impact with proper rate limiting, resource monitoring, and network segmentation in place.
🎯 Exploit Status
Exploitation requires authenticated access to trigger template parsing. The vulnerability is in the changelog generation feature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 17.4.6, 17.5.4, or 17.6.2
Vendor Advisory: https://gitlab.com/gitlab-org/gitlab/-/issues/496631
Restart Required: Yes
Instructions:
1. Backup your GitLab instance. 2. Update to GitLab 17.4.6, 17.5.4, or 17.6.2 depending on your current version. 3. Restart GitLab services. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable Changelog Generation
linuxTemporarily disable changelog generation feature to prevent exploitation.
gitlab-rails runner "ApplicationSetting.current.update!(changelog_enabled: false)"
Implement Rate Limiting
allAdd rate limiting on API endpoints related to changelog generation.
Configure in GitLab's rate limiting settings: Admin Area > Settings > Network > User and IP rate limits
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to GitLab instance
- Enable comprehensive monitoring for CPU spikes and implement alerting
🔍 How to Verify
Check if Vulnerable:
Check GitLab version: if running 13.9-17.4.5, 17.5.0-17.5.3, or 17.6.0-17.6.1, you are vulnerable.Check Version:
sudo gitlab-rake gitlab:env:info | grep 'GitLab version'Verify Fix Applied:
Verify GitLab version is 17.4.6, 17.5.4, or 17.6.2 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual CPU spikes
- Multiple failed changelog generation attempts
- High resource consumption in sidekiq logs
Network Indicators:
- Increased traffic to /api/v4/projects/*/repository/changelog endpoints
- Abnormal request patterns
SIEM Query:
source="gitlab.log" AND ("changelog" OR "template parsing") AND (error OR timeout OR "high cpu")