CVE-2024-8647: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab affecting all versions starting from 15.2 to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2. On self-hosted installations, it was possible to leak the anti-CSRF-token to an external site while the Harbor integration was enabled (NVD, GitLab Release).

The vulnerability is classified as a Client-Side Path Traversal issue in Harbor artifact links. The issue occurs when processing artifact links, where a maliciously crafted Harbor server response containing path traversal sequences could lead to CSRF token leakage. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (GitLab Release).

The vulnerability could allow an attacker to leak the CSRF token to an external site on self-hosted installations where the Harbor integration is enabled. This could potentially lead to Cross-Site Request Forgery attacks and account takeover by adding attacker-controlled email addresses to victim accounts. The impact is particularly significant for self-hosted instances without proper Content Security Policy (CSP) configurations (GitLab Issue).

The vulnerability requires an authenticated attacker with access to create or modify Harbor integration settings. The exploit involves creating a malicious Harbor server response that includes path traversal sequences, which when processed by GitLab, can leak the CSRF token. The vulnerability has been confirmed to be exploitable in self-hosted environments, particularly those without strict CSP configurations (GitLab Issue).

GitLab has addressed this vulnerability in versions 17.4.6, 17.5.4, and 17.6.2. Users are strongly recommended to upgrade to these patched versions immediately. GitLab.com has already been updated with the fix, and GitLab Dedicated customers do not need to take any action (GitLab Release).