CVE-2024-7404: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the Device OAuth flow (GitLab Advisory).

The vulnerability exists in the Device OAuth flow implementation where the Authorize button contained an ID attribute that made it susceptible to cross-window forgery attacks. This is classified as a medium severity issue with a CVSS v3.1 score of 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) (NVD, GitLab Advisory).

If exploited, this vulnerability could allow an attacker to gain full API access to a victim's account, including both read and write capabilities (GitLab Issue).

The vulnerability has been patched in GitLab versions 17.3.7, 17.4.4, and 17.5.2. Users are strongly recommended to upgrade to these patched versions immediately. GitLab.com is already running the patched version (GitLab Advisory).

The vulnerability was reported through GitLab's HackerOne bug bounty program by security researcher joaxcar. This issue was a regression of a similar vulnerability (CVE-2024-2177) that was previously fixed in version 17.1.1 (GitLab Advisory).