CVE-2024-9773
Published: 27 March 2025
Summary
CVE-2024-9773 is a low-severity Command Injection (CWE-77) vulnerability in Gitlab Gitlab. Its CVSS base score is 3.7 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Copy and Paste (T1204.004); ranked at the 11.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-9773 is an input validation issue in the Harbor registry integration within GitLab Enterprise Edition (EE). It affects all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, and all versions starting from 17.10 before 17.10.1. Classified as CWE-77 (command injection), the vulnerability carries a CVSS v3.1 base score of 3.7 (AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N) and was published on 2025-03-27.
A maintainer with sufficient privileges could exploit this issue to inject malicious code into CLI commands displayed in the GitLab UI. Exploitation requires local access, high attack complexity, and user interaction, such as another user copying and executing the tampered CLI commands on their system. Successful exploitation could result in low-impact confidentiality and integrity violations.
Mitigation details are available in the referenced advisories, including the GitLab issue at https://gitlab.com/gitlab-org/gitlab/-/issues/498557 and the HackerOne report at https://hackerone.com/reports/2671808, which align with upgrading to the specified patched versions beyond the affected ranges.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54314
Vulnerability details
An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions starting from 17.10 before 17.10.1. An input validation issue in the Harbor registry integration could have…
more
allowed a maintainer to add malicious code to the CLI commands shown in the UI.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The command injection vulnerability in displayed CLI commands directly enables attackers to tamper with commands that users copy and paste for execution, mapping to T1204.004 Malicious Copy and Paste.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation of inputs to the Harbor registry integration, preventing command injection (CWE-77) in generated CLI commands.
Filters malicious code from CLI commands before display in the GitLab UI, mitigating the risk of users executing injected commands.
Mandates timely flaw remediation by upgrading GitLab EE to patched versions, eliminating the input validation vulnerability.