CVE-2024-4024: GitLab account takeover, under certain conditions, when using Bitbucket as an OAuth provider
An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take over a GitLab account linked to another user's Bitbucket account, if Bitbucket is used as an OAuth 2.0 provider on GitLab.
Other sources
An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take over a GitLab account linked to another user’s Bitbucket account, if Bitbucket is used as an OAuth 2.0 provider on GitLab. This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, 7.3). It is now mitigated in the latest release and is assigned CVE-2024-4024.
— GitLab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.9.6Fixed in 16.10.4Fixed in 16.11.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.9.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.10.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.11.1 - Compensating control
If you cannot upgrade immediately, ensure Bitbucket is not used as an OAuth 2.0 provider on GitLab (to prevent account takeover via linked Bitbucket identities), until fixed versions (16.9.6, 16.10.4, or 16.11.1 or above) are deployed.
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-4024?
CVE-2024-4024 has been classified as a medium severity vulnerability due to the potential for unauthorized access under certain conditions.
How do I fix CVE-2024-4024?
To fix CVE-2024-4024, upgrade your GitLab instance to version 16.9.6 or later, or to 16.10.4 or later, depending on your current version.
Which versions of GitLab are affected by CVE-2024-4024?
CVE-2024-4024 affects GitLab versions from 7.8 to 16.9.6, from 16.10 to 16.10.4, and specifically version 16.11.0.
Can an attacker exploit CVE-2024-4024 without credentials?
No, an attacker would need to have valid Bitbucket account credentials to exploit CVE-2024-4024.
What components of GitLab are impacted by CVE-2024-4024?
CVE-2024-4024 impacts both GitLab Community Edition and Enterprise Edition.