CVE-2024-4201 is a newly discovered security vulnerability in GitLab, one of the most popular platforms for software development. The bug is a form of cross-site scripting (XSS) that can allow an attacker to inject harmful JavaScript and potentially compromise user accounts or steal sensitive data — just by tricking someone into viewing a raw XML file.

This vulnerability affects all GitLab versions from 5.1 before 16.10.7, from 16.11 before 16.11.4, and from 17. before 17..2. If you’re running an older or affected version, it’s critical you upgrade as soon as possible.

The Exploit: How Does It Work?

The problem lies in how GitLab handles raw XML file views in a project repository. If a specially crafted XML file is uploaded and later accessed via the "raw" viewer, GitLab might return this file with a browser-readable Content-Type, resulting in the browser rendering the XML as HTML. Under the right conditions, this can allow embedded JavaScript to execute in the victim’s browser — classic XSS.

Imagine you upload a malicious XML file. If you can get a GitLab user (for example, a project admin) to click on the "View raw" link, the browser could automatically run code you included in the file.

Below is a code snippet for an XML file that triggers the XSS if the vulnerability is present

<?xml version="1." encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ELEMENT foo ANY >
  <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<html>
  <head>
    <script>
      alert('XSS via CVE-2024-4201! Document.cookie: ' + document.cookie);
      // In a real attack, this could send cookies to a remote server
    </script>
  </head>
  <body>
    XSS triggered!
  </body>
</html>

If this file is uploaded to a GitLab repository, and a user browses to the raw URL GitLab generates (/project/repo/-/raw/branch/path/to/file.xml), the script may run in the user's browser.

What’s Dangerous About This? (With Real-World Example)

XSS attacks are dangerous because they let attackers do almost anything with the targeted account. With this particular exploit, an attacker could:

Update Your GitLab Installation!

- If you’re using any vulnerable version (from 5.1 to <16.10.7, 16.11 to <16.11.4, or 17. to <17..2), update immediately.
- GitLab security release 16.10.7, 16.11.4, 17..2

Never trust raw views of untrusted files, especially if you don’t control the source.

Temporary Mitigation:
If you can’t update right away, restrict access to raw file URLs or filter out .xml files in your web proxy.

Defensive Development Tip:
When serving raw content, always set a safe Content-Type (like text/plain) and use Content-Disposition: attachment.

Original References & Further Reading

- GitLab Advisory (GHSA-hhj5-xm6q-v3xf)
- GitLab Release Notes — Security Fixes
- NIST National Vulnerability Database: CVE-2024-4201
- OWASP XSS Cheat Sheet

Conclusion

CVE-2024-4201 highlights the dangers of serving raw files without proper content handling, especially in developer tools like GitLab. The fix is straightforward: update your GitLab instance immediately and be cautious when viewing raw files, especially from outside contributors.

If you run a GitLab server, check your version now and patch without delay. If you don’t control your GitLab instance, reach out to your admin to make sure they’re aware.

Stay safe, patch early, and never trust user-uploaded files!

Timeline

Published on: 06/12/2024 23:15:49 UTC
Last modified on: 06/14/2024 19:18:50 UTC