Loading vulnerability…
Unauthorized Project Deploy Token Creation in GitLab CE/EE
CVE-2024-5470 is an improper privilege-management vulnerability in GitLab Community Edition and Enterprise Edition. In affected releases, a Guest user granted the custom-role permission admin_push_rules may be able to create project-level deploy tokens, despite being a low-privilege project member. The issue affects versions from 17.0 before 17.0.4 and versions from 17.1 before 17.1.2.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated Guest user with the admin_push_rules custom-role permission may create project-level deploy tokens without the intended authorization. This can circumvent project-level access controls governing deploy-token creation.
If you can’t patch tonight, do this now.
Install the GitLab security updates. Until upgrades can be completed, review custom roles and remove the admin_push_rules permission from Guest users where it is not required.
Patch, then assume compromise.
Upgrade GitLab Community Edition or Enterprise Edition to version 17.1.2, 17.0.4, or 16.11.6 or later, as applicable.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.