Loading vulnerability…
Cross-site scripting in GitLab raw XML/XHTML file viewing
CVE-2024-4207 is a cross-site scripting vulnerability in GitLab affecting Community Edition and Enterprise Edition. It affects all versions starting from 5.1 before 17.0.6, 17.1 before 17.1.4, and 17.2 before 17.2.2. Under specific circumstances, an XML file stored in a repository and viewed in raw mode can be rendered by the browser as HTML rather than treated as inert raw content. This content-type or rendering confusion enables attacker-controlled markup in the repository file to execute in the victim’s browser in the context of the GitLab application.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in execution of attacker-controlled script in a victim user’s browser while they view the crafted raw XML/XHTML content. This can enable session hijacking, unauthorized actions performed in the victim’s context, access to data available to the victim in GitLab, and other client-side compromise effects typical of stored XSS.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting access to untrusted repositories and limiting who can upload or modify repository content that may be viewed through the web interface. Avoid viewing untrusted XML/XHTML repository files in raw mode until the instance is upgraded. Additional browser-side protections may reduce impact but are not a substitute for patching.
Patch, then assume compromise.
Upgrade GitLab CE or EE to a fixed release: 17.0.6, 17.1.4, 17.2.2, or later. Self-managed installations running affected versions should be updated immediately to a patched version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.