Loading vulnerability…
Improper permission check in GitLab CE/EE LFS token repository access
CVE-2024-3035 is a permission check vulnerability in GitLab Community Edition and Enterprise Edition in which Git LFS tokens were allowed to read from and write to repositories owned by the associated user beyond the intended authorization boundaries. The issue affects GitLab CE/EE versions starting from 8.12 before 17.0.6, 17.1 before 17.1.4, and 17.2 before 17.2.2. The flaw stems from insufficient authorization enforcement for LFS token operations against user-owned repositories, enabling repository access that should have been denied.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in unauthorized repository read and write access through Git LFS token use. This can expose repository contents, permit unauthorized modification of repository data, and undermine repository integrity and access control expectations for user-owned projects.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting issuance and use of Git LFS tokens where operationally feasible, reviewing token scope and repository access patterns, and monitoring for anomalous LFS-based read or write activity against user-owned repositories. These measures are temporary risk-reduction steps and do not replace upgrading to a fixed version.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release. The patched versions are 17.0.6, 17.1.4, and 17.2.2 or later, depending on the deployed release train. GitLab.com was already running a patched version at the time of disclosure.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.