CVE-2024-8402
Published: 13 March 2025
Description
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
Security Summary
CVE-2024-8402 is an input validation issue in the Google Cloud IAM integration feature of GitLab Enterprise Edition (EE). It affects all versions starting from 17.2 before 17.7.7, all versions starting from 17.8 before 17.8.5, and all versions starting from 17.9 before 17.9.2. Classified as CWE-77 (Command Injection), the vulnerability carries a CVSS v3.1 base score of 3.7 (AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N).
Exploitation requires a Maintainer with local access to perform a high-complexity attack involving user interaction. Successful exploitation enables the Maintainer to introduce malicious code through the flawed input validation in the Google Cloud IAM integration.
Advisories recommend upgrading to patched versions: 17.7.7 or later for the 17.2 series, 17.8.5 or later for the 17.8 series, and 17.9.2 or later for the 17.9 series. Further details on the issue and resolution are documented in the GitLab issue tracker at https://gitlab.com/gitlab-org/gitlab/-/issues/482813 and the HackerOne disclosure report at https://hackerone.com/reports/2601569.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The command injection vulnerability (CWE-77) in the Google Cloud IAM integration directly enables arbitrary command execution on the GitLab server.