CVE-2024-9164: RCE in GitLab EE

The impact of CVE-2024-9164 is severe. Successful exploitation allows an attacker to execute arbitrary code within the context of the GitLab runner, effectively granting them control over the pipeline execution environment. This can lead to complete compromise of the GitLab instance, including data exfiltration, modification of code repositories, and potentially lateral movement to other systems within the network. An attacker could inject malicious code into a pipeline, which would then be executed with elevated privileges, enabling them to perform actions such as deploying malicious artifacts, accessing sensitive data, or establishing a persistent backdoor. The ability to run pipelines on arbitrary branches bypasses normal access controls, significantly expanding the attack surface.

1. Reserved2024-09-24
2. Published2024-10-11
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-9164 is to upgrade GitLab EE to version 17.4.2 or later. If immediate upgrading is not possible, consider restricting pipeline execution to trusted branches and users. Implement strict branch protection rules to prevent unauthorized users from creating or modifying pipelines. Review and audit existing pipelines for any suspicious activity. While a WAF cannot directly prevent this RCE, it can help detect and block malicious payloads within pipeline configurations. Monitor GitLab logs for unusual pipeline activity, particularly those originating from unexpected branches or users.