CVE-2024-8402
Published: 13 March 2025
Summary
CVE-2024-8402 is a low-severity Command Injection (CWE-77) vulnerability in Gitlab Gitlab. Its CVSS base score is 3.7 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 25.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-8402 is an input validation issue in the Google Cloud IAM integration feature of GitLab Enterprise Edition (EE). It affects all versions starting from 17.2 before 17.7.7, all versions starting from 17.8 before 17.8.5, and all versions starting from 17.9 before 17.9.2. Classified as CWE-77 (Command Injection), the vulnerability carries a CVSS v3.1 base score of 3.7 (AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N).
Exploitation requires a Maintainer with local access to perform a high-complexity attack involving user interaction. Successful exploitation enables the Maintainer to introduce malicious code through the flawed input validation in the Google Cloud IAM integration.
Advisories recommend upgrading to patched versions: 17.7.7 or later for the 17.2 series, 17.8.5 or later for the 17.8 series, and 17.9.2 or later for the 17.9 series. Further details on the issue and resolution are documented in the GitLab issue tracker at https://gitlab.com/gitlab-org/gitlab/-/issues/482813 and the HackerOne disclosure report at https://hackerone.com/reports/2601569.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54055
Vulnerability details
An issue was discovered in GitLab EE affecting all versions starting from 17.2 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. An input validation issue in the Google Cloud IAM integration feature…
more
could have enabled a Maintainer to introduce malicious code.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The command injection vulnerability (CWE-77) in the Google Cloud IAM integration directly enables arbitrary command execution on the GitLab server.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs to the Google Cloud IAM integration feature to reject malicious command injection payloads.
Restricts inputs to the integration to authorized types and formats, mitigating command injection by blocking unauthorized payloads.
Ensures timely remediation of the input validation flaw through prioritization and patching of affected GitLab versions.