Loading vulnerability…
Shell code injection in GitLab EE Harbor registry integration CLI helper commands
CVE-2024-9773 is an input validation vulnerability in GitLab Enterprise Edition's Harbor registry integration. It affects all versions from 14.9 before 17.8.6, from 17.9 before 17.9.3, and from 17.10 before 17.10.1. The flaw allows a user with Maintainer privileges to supply a malicious Harbor project name configuration that is incorporated into CLI commands displayed in the GitLab UI for helper-script usage. Because the project name is not properly validated or sanitized before being embedded into those command strings, attacker-controlled shell code can be injected into the displayed commands.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause users who copy and execute the displayed helper-script CLI commands to run attacker-controlled shell code in their own shell environment. This can lead to arbitrary command execution in the security context of the user running the command, potentially resulting in workstation compromise, credential exposure, unauthorized access to registries or repositories reachable from that host, and follow-on lateral movement depending on the victim user's privileges and environment.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable or avoid use of the Harbor registry integration helper-script workflow and do not trust or execute CLI commands generated from Harbor project name data. Restrict who can hold Maintainer privileges for affected projects, review Harbor integration configuration changes for abuse, and require manual validation of displayed commands before execution. These measures only reduce exposure and do not fully remediate the underlying flaw.
Patch, then assume compromise.
Upgrade GitLab EE to a fixed release: 17.8.6 or later in the 17.8 series, 17.9.3 or later in the 17.9 series, or 17.10.1 or later in the 17.10 series. Self-managed deployments should be updated to one of these patched versions or a newer release that includes the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.