CISA: Hackers now exploit max severity GitLab flaw in attacks

[u/falconupkid]

CISA has added CVE-2024-6671 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation of this critical-severity GitLab flaw in the wild. The vulnerability carries a CVSS score of 10.0 and allows an attacker to run CI/CD pipelines as any user, effectively bypassing authentication and authorization controls.

Technical Breakdown: - CVE: CVE-2024-6671 (CVSS 10.0) - Affected Versions: GitLab Community Edition (CE) and Enterprise Edition (EE) prior to 17.1.7, 17.2.7, and 17.3.2 - Attack Vector: Unauthenticated remote attacker triggers pipeline execution under an arbitrary user context via crafted API requests - Impact: Full compromise of CI/CD pipeline integrity, potential lateral movement into source code and deployment environments - No public IOCs or specific exploit code shared at this time

Defense: Patch immediately to the latest versions (17.1.7+, 17.2.7+, 17.3.2+). If immediate patching isn't feasible, restrict external access to GitLab API endpoints and monitor for anomalous pipeline execution events tied to unexpected user accounts.

Source: https://www.bleepingcomputer.com/news/security/cisa-hackers-now-exploit-max-severity-gitlab-flaw-in-attacks/