CVE-2024-4835: 
GitLab vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability, identified as CVE-2024-4835, was discovered in GitLab affecting versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. The vulnerability was reported through GitLab's HackerOne bug bounty program and was patched on May 22, 2024. This high-severity vulnerability (CVSS score 8.0) exists within the VS code editor (Web IDE) component of GitLab (GitLab Release, Security Online).

The vulnerability exists in the webWorkerExtensionHostIframe.html file, which is responsible for running VS Code extensions and communicates with its parent window via postMessages. The security flaw stems from improper validation of message origins in the iframe, allowing malicious sites to interact with the extension host as if it were the legitimate web IDE. This enables attackers to load arbitrary JavaScript files as extensions, leading to code execution in the gitlab.com origin. The vulnerability received a CVSS score of 8.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) (GitLab Release).

The vulnerability allows attackers to craft malicious pages that can exfiltrate sensitive user information and potentially lead to full account takeover. When exploited successfully, attackers could gain unauthorized access to victim accounts with just a single click from the target user, including the ability to create malicious API tokens (Security Online).

The vulnerability can be exploited by creating a malicious page that includes the webWorkerExtensionHostIframe.html file in an iframe. The attacker can then send crafted messages to load arbitrary JavaScript code, effectively bypassing origin validation. The attack requires user interaction but can be executed with a single click from the victim (GitLab Issue).

GitLab has released security patches in versions 17.0.1, 16.11.3, and 16.10.6 for both Community Edition (CE) and Enterprise Edition (EE). Organizations running affected versions are strongly advised to upgrade to the latest patched version immediately. GitLab.com has already been updated with the necessary security fixes (GitLab Release).