Loading vulnerability…
Privilege Escalation via LFS Tokens in GitLab CE/EE
CVE-2024-8114 is a high-severity privilege-escalation vulnerability in GitLab Community Edition and Enterprise Edition involving LFS token handling. It affects all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Successful exploitation requires access to a victim's Personal Access Token, after which the flaw can be abused through the LFS token mechanism to obtain privileges beyond those originally granted.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker who has obtained a victim's Personal Access Token can leverage this flaw to escalate privileges within GitLab. The resulting impact includes unauthorized access to resources and actions at a higher privilege level than the compromised token should permit, with potential confidentiality and integrity consequences across affected GitLab environments.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by tightly controlling and rotating Personal Access Tokens, revoking any tokens suspected of compromise, minimizing token privileges and lifetime where operationally feasible, and monitoring for anomalous use of PATs and LFS-related activity. These measures do not replace upgrading to a fixed version.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release. Patched versions are 17.4.5, 17.5.3, and 17.6.1 or later, depending on the deployed release train. Self-managed installations should be updated immediately to a patched version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.