CVE-2024-1066: Resource exhaustion using GraphQL vulnerabilitiesCountByDay
An issue has been discovered in GitLab EE affecting all versions from 13.3.0 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows an attacker to do a resource exhaustion using GraphQL vulnerabilitiesCountByDay
Other sources
An issue has been discovered in GitLab EE affecting all versions from 13.3.0 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows an attacker to do a resource exhaustion using GraphQL vulnerabilitiesCountByDay. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). It is now mitigated in the latest release and is assigned CVE-2024-1066.
— GitLab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.6.7Fixed in 16.7.5Fixed in 16.8.2 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 16.6.7 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 16.7.5 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 16.8.2 - Compensating control
If you cannot upgrade immediately, mitigate the resource exhaustion risk caused by GraphQL vulnerabilitiesCountByDay by limiting access/rate to the affected GraphQL functionality until patched (issue is mitigated in the latest release and assigned CVE-2024-1066).
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-1066?
CVE-2024-1066 is considered a high severity vulnerability due to its potential for resource exhaustion in GitLab.
How do I fix CVE-2024-1066?
To fix CVE-2024-1066, upgrade your GitLab instance to versions 16.6.7, 16.7.5, or 16.8.2 or later.
What versions of GitLab are vulnerable to CVE-2024-1066?
All GitLab versions from 13.3.0 prior to 16.6.7, and from 16.7 prior to 16.7.5 and 16.8 prior to 16.8.2 are vulnerable to CVE-2024-1066.
What type of attack does CVE-2024-1066 allow?
CVE-2024-1066 allows an attacker to perform a resource exhaustion attack using the GraphQL `vulnerabilitiesCountByDay` query.
Is CVE-2024-1066 related to GitLab's GraphQL interface?
Yes, CVE-2024-1066 specifically affects GitLab's GraphQL interface, allowing for potential misuse.