GitLab 中的服务器端请求伪造 (Server-Side Request Forgery, SSRF)

The SSRF vulnerability in GitLab EE enables an attacker to craft malicious requests that appear to originate from the GitLab server itself. By exploiting the custom Maven Dependency Proxy URL, an attacker could potentially bypass security controls and access sensitive internal resources that are not directly exposed to the internet. This could include accessing internal APIs, databases, or other services. The potential impact ranges from information disclosure to potentially gaining control over internal systems, depending on the resources accessible through the SSRF vulnerability. Successful exploitation could lead to data breaches, privilege escalation, and disruption of GitLab services.

Organizations utilizing GitLab Enterprise Edition (EE) with the Maven Dependency Proxy feature enabled are at risk. This includes development teams relying on custom Maven repositories hosted internally and those using GitLab as a central artifact repository. Legacy GitLab EE installations running versions prior to 17.3.2 are particularly vulnerable.

• gitlab: Examine GitLab logs for outbound requests originating from the Maven Dependency Proxy endpoint that target internal resources.

journalctl -u gitlab-sshd | grep 'Maven Dependency Proxy'

• gitlab: Check the configuration of the Maven Dependency Proxy to ensure it is not overly permissive.

/opt/gitlab/embedded/service/gitlab-rails/config/gitlab.yml | grep 'maven_dependency_proxy'

• generic web: Monitor access logs for requests to the Maven Dependency Proxy endpoint with unusual or unexpected parameters.

grep 'maven_dependency_proxy' /var/log/nginx/access.log

1. 2024-09-12Disclosure

   disclosure

1. 已保留2024-09-09
2. 发布日期2024-09-12
3. 修改日期2024-09-13
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2024-8635 is to upgrade GitLab EE to version 17.3.2 or later. Prior to upgrading, it is recommended to review and test any custom Maven Dependency Proxy configurations to ensure they are not inadvertently exposing sensitive resources. Consider implementing a Web Application Firewall (WAF) with SSRF protection rules to block malicious requests. Monitor GitLab logs for suspicious outbound requests originating from the Maven Dependency Proxy endpoint. After upgrading, confirm the fix by attempting to access an internal resource via the Maven Dependency Proxy URL; the request should be denied.