Loading vulnerability…
Command Injection in GitLab EE Product Analytics Cube Integration
CVE-2024-8640 is a high-severity command injection vulnerability in GitLab Enterprise Edition affecting all versions from 16.11 before 17.1.7, from 17.2 before 17.2.5, and from 17.3 before 17.3.2. The flaw is caused by incomplete input filtering in the Product Analytics funnels YAML configuration. An attacker with the ability to influence this YAML configuration can inject commands that are passed to a connected Cube server. The issue affects the Product Analytics integration path rather than GitLab CE, and arises from insufficient validation or sanitization of attacker-controlled input before it is used in a command-processing context on the connected analytics component.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthorized command injection against a connected Cube server used by GitLab EE Product Analytics. This can expose data processed or accessible by that server and may enable further compromise of the analytics environment depending on the Cube server's privileges, configuration, and network reachability. Available information indicates confidentiality impact, while broader integrity or availability impact is possible but not specifically documented.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling or restricting use of the Product Analytics funnels functionality and limiting or severing GitLab's connectivity to the connected Cube server where operationally feasible. Restrict access to users who can modify relevant analytics YAML configuration, apply network segmentation and least-privilege controls to the Cube server, and increase monitoring for suspicious command execution or anomalous activity involving the analytics integration. These measures are temporary and do not replace upgrading to a fixed version.
Patch, then assume compromise.
Upgrade GitLab Enterprise Edition to a fixed release: 17.1.7 or later on the 17.1 branch, 17.2.5 or later on the 17.2 branch, or 17.3.2 or later on the 17.3 branch. Self-managed deployments running affected versions should prioritize patching. If compromise is suspected, perform post-upgrade investigation because applying the patch does not remediate any prior unauthorized activity on the connected analytics infrastructure.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.