Loading vulnerability…
SSRF in GitLab EE Maven Dependency Proxy
CVE-2024-8635 is a server-side request forgery vulnerability in GitLab Enterprise Edition affecting versions starting from 16.8 before 17.1.7, from 17.2 before 17.2.5, and from 17.3 before 17.3.2. The flaw exists in handling of a custom Maven Dependency Proxy URL, which could be abused to cause the GitLab server to issue requests to internal resources. This allows an attacker to leverage the GitLab instance as a proxy to reach network locations that may not be directly accessible from the attacker’s environment.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to induce the vulnerable GitLab EE server to send requests to internal resources, potentially exposing sensitive internal services or data reachable from the server-side network context. Because the issue is SSRF, the primary impact is unauthorized access to otherwise non-public network resources and information disclosure through the application’s trusted position within the internal environment.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict or disable use of the affected Dependency Proxy functionality involving custom Maven Dependency Proxy URLs where feasible, and enforce outbound network egress controls from the GitLab server to limit access to internal-only services and sensitive metadata endpoints. Additional monitoring for anomalous server-originated requests to internal resources can help reduce exposure until upgrades are completed.
Patch, then assume compromise.
Upgrade GitLab Enterprise Edition to a fixed release: 17.1.7 or later in the 17.1 series, 17.2.5 or later in the 17.2 series, or 17.3.2 or later in the 17.3 series. Self-managed deployments running affected versions should be updated immediately to a patched version appropriate for their release track.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.