Unzureichende Beschränkung eines Pfadnamens auf ein eingeschränktes Verzeichnis ('Path Traversal') in GitLab

The path traversal vulnerability allows an attacker to manipulate file paths, potentially accessing files outside of the intended directories. This can lead to a denial-of-service (DoS) by exhausting system resources or corrupting critical files. More concerningly, it enables unauthorized access to sensitive data stored within the GitLab instance, such as configuration files, user credentials, or project data. The ability to read restricted files significantly expands the attack surface and could lead to further exploitation, including privilege escalation or data exfiltration. While the description doesn't specify a direct remote code execution (RCE) path, the ability to read arbitrary files could be a stepping stone for such attacks depending on the content of those files.

Organizations running GitLab CE/EE in production environments, particularly those using versions 16.9 through 16.11.1, are at risk. Shared hosting environments where multiple users share a GitLab instance are also particularly vulnerable, as a compromised user account could potentially be used to exploit the vulnerability and gain access to other users' data or system resources. Legacy GitLab configurations with relaxed file permissions are also at increased risk.

• ruby: Monitor GitLab logs for unusual file access patterns or attempts to access files outside of expected directories. Use grep to search for suspicious path manipulation attempts in access logs. • generic web: Use curl to test for path traversal vulnerabilities by attempting to access files outside of the intended directory structure. Example: curl 'https://gitlab.example.com/../../../../etc/passwd' • linux / server: Examine GitLab's audit logs (if enabled) for suspicious file access events. Use journalctl -f to monitor GitLab's logs in real-time for unusual activity. • database (postgresql): If GitLab's database contains file paths, query the database for any unexpected or unusual file paths that might indicate an attempted exploit.

1. 2024-04-25Disclosure

   disclosure

2. 2024-04-25CISA KEV

   kev

1. Reserviert2024-03-13
2. Veröffentlicht2024-04-25
3. Geändert2025-11-20
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-2434 is to upgrade GitLab to version 16.11.1 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting file access permissions and carefully reviewing file paths used in GitLab operations. Implementing a Web Application Firewall (WAF) with rules to filter out malicious path traversal attempts can provide an additional layer of defense. Monitor GitLab logs for unusual file access patterns or attempts to access restricted directories. After upgrading, confirm the fix by attempting to access restricted files via the vulnerable endpoint and verifying that access is denied.