CVE-2024-9693
Incorrect Authorization (CWE-863)
Summary
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster under specific configurations. This vulnerability is related to incorrect authorization (CWE-863).
Impact
This vulnerability could allow an attacker to gain unauthorized access to the Kubernetes agent in a cluster under specific configurations. Given the CVSS score of 8.5 (High severity) and the impact ratings, successful exploitation could lead to a high impact on confidentiality, integrity, and availability of the affected systems. The attack vector is network-based, requires low privileges, and no user interaction, but has high attack complexity. The scope is changed, which means the vulnerability can affect resources beyond its security scope.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
Patches are available. Users should upgrade to GitLab version 17.3.7, 17.4.4, or 17.5.2 or later, depending on their current version track.
Mitigation
1. Upgrade GitLab to the latest patched version (17.3.7, 17.4.4, or 17.5.2 or later) as soon as possible. 2. If immediate patching is not possible, monitor Kubernetes agent activities closely for any signs of unauthorized access. 3. Implement network segmentation to limit access to the Kubernetes agent. 4. Review and strengthen authorization mechanisms for Kubernetes agent access. 5. Regularly audit and update access controls for GitLab and associated Kubernetes clusters.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Timeline
NVD published the first details for CVE-2024-9693
A CVSS base score of 8.5 has been assigned.
Feedly found the first article mentioning CVE-2024-9693. See article
Feedly estimated the CVSS score as MEDIUM
Detection for the vulnerability has been added to Nessus (210944)
EPSS Score was set to: 0.04% (Percentile: 10.2%)