CVE-2024-9512: 
GitLab vulnerability analysis and mitigation

CVE-2024-9512 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in GitLab Enterprise Edition (EE) that may allow unauthorized cloning of private repositories. It affects all GitLab EE versions prior to 17.10.8, versions 17.11.0 through 17.11.3, and versions 18.0.0 through 18.0.1. The vulnerability was disclosed on June 12, 2025, with patches released on June 11, 2025. It carries a CVSS v3.1 base score of 5.9 (Medium) per NVD, or 5.3 (Medium) per ENISA (GitLab Advisory, Red Hat CVE).

The vulnerability is classified as CWE-367 (Time-of-Check Time-of-Use Race Condition). It occurs in GitLab EE's Geo replication feature: when a secondary (replica) node is out of sync with the primary, a race condition window exists during which an attacker may be able to clone a private repository without proper authorization. The attack requires no authentication and no user interaction, but has high attack complexity due to the timing-dependent nature of the race condition. The issue was originally reported via HackerOne (report #2683469) and tracked in GitLab's internal issue tracker (GitLab Issue, HackerOne).

Successful exploitation results in unauthorized read access to private repository contents, representing a high confidentiality impact with no integrity or availability impact. An attacker who times the exploit correctly during a Geo secondary node sync gap could clone sensitive source code, credentials embedded in repositories, or proprietary data. The scope is limited to GitLab EE deployments using Geo replication; GitLab Community Edition and GitLab.com (SaaS) configurations without Geo secondaries are not affected by this specific vector (GitLab Advisory, Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2024-9512. The EPSS score is extremely low at 0.000080 (approximately 0.008%), reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity required to reliably trigger the race condition significantly limits practical exploitability (GitLab Advisory).

GitLab has released patched versions addressing this vulnerability: 17.10.8, 17.11.4, and 18.0.2. Administrators running GitLab EE with Geo replication enabled should upgrade to one of these versions immediately. No specific configuration-based workaround has been published; disabling Geo secondary nodes would eliminate the attack surface but is not a practical long-term solution for organizations relying on Geo for disaster recovery or performance. Upgrade guidance is available in the official patch release notes (GitLab Advisory).

The vulnerability was covered by several security news outlets shortly after disclosure, including SecurityOnline.info, GBHackers, and CyberPress, as part of broader coverage of the June 2025 GitLab patch release that addressed multiple vulnerabilities including account takeover and code injection issues. Coverage was routine and did not indicate significant alarm, consistent with the Medium severity rating and high exploitation complexity (SecurityOnline, GBHackers).