CVE-2024-0402 allowed an authenticated user to write files to arbitrary locations on a GitLab server while creating a workspace. GitLab rated the flaw critical, with a CVSS 3.1 score of 9.9. The affected and fixed versions below are from GitLab’s January 25, 2024 advisory; they are historical patch targets, not current upgrade recommendations.
What is CVE-2024-0402?
CVE-2024-0402 is an arbitrary-file-write vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). GitLab said an authenticated user could write files to arbitrary locations on the server during workspace creation. The advisory rated it critical and assigned a CVSS 3.1 score of 9.9, with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The vector records GitLab’s severity assessment; it does not establish that exploitation occurred in the wild.
GitLab’s January 25, 2024 security release described the issue as follows: “An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.5.8, 16.6 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace.” GitLab’s release notice credits discovery to GitLab team member joernchen.
Which GitLab versions did the advisory list as affected?
GitLab’s January 25, 2024 notice listed these GitLab CE/EE ranges as affected and named the corresponding fixed releases:
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
| Affected range | Fixed release named in the advisory |
|---|---|
| 16.0 before 16.5.8 | 16.5.8 |
| 16.6 before 16.6.6 | 16.6.6 |
| 16.7 before 16.7.4 | 16.7.4 |
| 16.8 before 16.8.1 | 16.8.1 |
These ranges and fixes are exactly those stated in the 2024 release notice. GitLab noted that when a deployment type is not singled out in an advisory, all types are affected. The release also stated that 16.5.8 contained a fix for this vulnerability only, not the other listed changes in that post.
How should you upgrade GitLab?
If you are assessing a historical installation, compare its installed major-minor branch and version with the affected ranges above; the named fixes show the remediation GitLab issued at disclosure. For an upgrade now, do not target those old 16.x patches simply because they appear in this advisory. Check your installed version against GitLab’s current security notices and supported-version guidance, then select an appropriate current release. GitLab’s security FAQ says it recommends at least the latest security release for a supported version.
- Identify your installed GitLab version and edition. Use your installation’s normal version-checking method and note whether it is CE or EE.
- Check current GitLab security and support guidance. Review the latest security release notices and confirm which versions remain supported before choosing an upgrade target.
- Follow the upgrade path for that target. Use GitLab’s current upgrade documentation and release guidance for your installation; do not assume a historical patch number is suitable for a present-day deployment.
For installations that were on an affected branch at the time of disclosure, GitLab recommended upgrading to a fixed release. The appropriate action today depends on the installed version and current support status, not only on the 2024 advisory.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What did GitLab say about its hosted services?
In its January 25, 2024 advisory, GitLab said GitLab.com and GitLab Dedicated were already running the patched version. That statement describes their status at the time of that release; it is not a claim about the present-day status of any particular deployment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
