About the Vulnerability
Introduction
GitLab is an open-source project for repository management systems, using Git as the code management tool, and built upon this foundation as a Web service.
Summary
On November 27, 2024, Sangfor FarSight Labs received notification that a GitLab component contains information of Privilege Escalation Vulnerability(CVE-2024-8114), classified as high in threat level.
GitLab CE/EE contains a vulnerability that allows attackers to access the victim's Personal Access Token (PAT) to escalate privileges, which can lead to sensitive information disclosure and server compromise.
Affected Versions
8.12 ≤ GitLab CE/EE< 17.4.5
17.5 ≤ GitLab CE/EE< 17.5.3
17.6 ≤ GitLab CE/EE< 17.6.1
Solutions
Remediation Solutions
Check the System Version
Enter the GitLab server address/help directly on the browser:
The version information of GitLab is displayed on the web page.
Official Solution
The latest versions have been officially released to fix the vulnerability. Affected users are recommended to update the version of GitLab CE/EE to the following versions:
GitLab CE/EE 17.4.5
GitLab CE/EE 17.5.3
GitLab CE/EE 17.6.1
And versions above
Download link: https://about. gitlab.com/update
Sangfor Solutions
Risky Assets Detection
Support is provided for proactive detection of GitLab; and it is capable of batch identifying the affected asset conditions of this event in business scenarios. Related products are as follows:
[Sangfor CWPP] has released an asset detection scheme, with Fingerprint ID: 0006687.
[Sangfor Host Security] has released an asset detection scheme, with Fingerprint ID: 0006687.
Vulnerability Proactive Detection
Support is provided for proactive detection of GitLab Privilege Escalation Vulnerability(CVE-2024-8114); and it is capable of quickly batch identifying whether there are vulnerability risks in business scenarios. Related products are as follows:
[Sangfor Host Security] is expected to release a detection scheme on December 1, 2024, with Rule ID: SF-0005-21033.
[Sangfor Cyber Guardian MDR] is expected to release a detection scheme on December 2, 2024 , with Rule ID: SF-0005-21034.
[Sangfor Omni-Command] is expected to release a detection scheme on December 1, 2024(requiring Host Security component capabilities), with Rule ID: SF-0005-21033.
Timeline
On November 27, 2024, Sangfor FarSight Labs received notification of GitLab Privilege Escalation Vulnerability.
On November 27, 2024, Sangfor FarSight Labs released a vulnerability alert.
References
https://about.gitlab.com/releases/2024/11/26/patch-release-gitlab-17- 6-1-released/
