CVE-2024-9870

CVE-2024-9870 is an external service interaction vulnerability in GitLab Enterprise Edition (EE), affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2. Classified under CWE-441 (Unintended Proxy or Intermediary) and CWE-918 (Server-Side Request Forgery), it allows an attacker to cause the GitLab server to send requests to unintended services. The vulnerability received a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and was published on 2025-02-12.

A low-privileged authenticated user (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation tricks the GitLab server into making unauthorized outbound requests to external services, resulting in low confidentiality impact (C:L) within the unchanged security scope (S:U), with no integrity or availability effects.

Mitigation requires upgrading to GitLab EE 17.6.5, 17.7.4, 17.8.2, or later versions, as indicated by the affected version ranges. Official advisories are available in the GitLab issue tracker at https://gitlab.com/gitlab-org/gitlab/-/issues/498911 and the HackerOne disclosure report at https://hackerone.com/reports/2734142.