PT-2024-1687 · Gitlab · Gitlab Ce/Ee+1

Michał Zając · Published 2024-02-07 · Updated 2024-10-08 · CVE-2024-1066

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GitLab EE versions 13.3.0 through 16.6.7 GitLab EE versions 16.7 through 16.7.5 GitLab EE versions 16.8 through 16.8.2

Description The issue is related to an uncontrolled resource consumption in GitLab EE, which can be exploited by a remote attacker to cause a denial of service. The exploitation is possible using the GraphQL vulnerabilitiesCountByDay endpoint.

Recommendations For GitLab EE versions 13.3.0 through 16.6.7, update to a version after 16.6.7. For GitLab EE versions 16.7 through 16.7.5, update to a version after 16.7.5. For GitLab EE versions 16.8 through 16.8.2, update to a version after 16.8.2. As a temporary workaround, consider restricting access to the GraphQL vulnerabilitiesCountByDay endpoint to minimize the risk of exploitation.

Exploit

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BDU:2024-01375

BIT-GITLAB-2024-1066

CVE-2024-1066

Affected Products

Gitlab

Gitlab Ce/Ee

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1066.json · Exploit
• https://ubuntu.com/security/CVE-2024-1066 · Vendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/420341 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1066 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2024-1066 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-1066 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-1066 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1066 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01375 · Security Note
• https://twitter.com/CVEnew/status/1755354393896247811 · Twitter Post
• https://t.me/cvenotify/72948 · Telegram Post
• https://t.me/cvenotify/70560 · Telegram Post
• https://about.gitlab.com/releases/2024/02/07/security-release-gitlab-16-8-2-released/#resource-exhaustion-using-graphql-vulnerabilitiescountbyday · Note
• https://about.gitlab.com/releases/2024/02/07/security-release-gitlab-16-8-2-released · Note
• https://twitter.com/VulmonFeeds/status/1755376201466630251 · Twitter Post