CVE-2024-6595: 
GitLab vulnerability analysis and mitigation

A vulnerability (CVE-2024-6595) was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2. The issue allows attackers to upload an NPM package with conflicting package data, creating a manifest confusion vulnerability. This vulnerability was discovered internally by a GitLab team member Ameya Darshan (GitLab Release).

The vulnerability stems from the ability to upload NPM packages with inconsistent data between the manifest and the actual package contents. The issue has been assigned a CVSS v3.1 Base Score of 3.0 (LOW) with vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N by GitLab Inc., while the NVD assessment rates it at 5.3 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-451 (User Interface Misrepresentation of Critical Information) (NVD Database).

The vulnerability allows attackers to create discrepancies between package manifest data and actual package contents, potentially leading to security tools being misled about package contents, dependencies, and scripts. This can result in the execution of undisclosed scripts and installation of unlisted dependencies, posing a significant risk to the npm ecosystem (NPM Blog).

The vulnerability can be exploited by uploading NPM packages with conflicting data between the manifest and package contents. This manifest confusion attack has been demonstrated to affect various package managers and tools in the npm ecosystem. The issue has been actively researched and documented, with proof-of-concept demonstrations available (GitLab Issue).

The vulnerability has been patched in GitLab versions 16.11.6, 17.0.4, and 17.1.2. Users are strongly advised to upgrade to these or newer versions. GitLab.com and GitLab Dedicated instances have already been updated with the patched version (GitLab Release).