CVE-2024-9870
SSRF in Gitlab 15.11.0 – 17.6.5
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2024-9870 is a medium-severity Confused Deputy (CWE-441) vulnerability in Gitlab Gitlab. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Proxy (T1090); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-16 (Security and Privacy Attributes) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-9870 is an external service interaction vulnerability in GitLab Enterprise Edition (EE), affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2. Classified under CWE-441 (Unintended Proxy or Intermediary) and CWE-918 (Server-Side Request Forgery), it allows an attacker to cause the GitLab server to send requests to unintended services. The vulnerability received a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and was published on 2025-02-12.
A low-privileged authenticated user (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation tricks the GitLab server into making unauthorized outbound requests to external services, resulting in low confidentiality impact (C:L) within the unchanged security scope (S:U), with no integrity or availability effects.
Mitigation requires upgrading to GitLab EE 17.6.5, 17.7.4, 17.8.2, or later versions, as indicated by the affected version ranges. Official advisories are available in the GitLab issue tracker at https://gitlab.com/gitlab-org/gitlab/-/issues/498911 and the HackerOne disclosure report at https://hackerone.com/reports/2734142.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4968
Vulnerability Data
An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.2.1V3.5.1V3.5.3V3.5.8
Mitigating Controls (NIST 800-53 r5) AI
Associating and preserving security attributes such as original source identity prevents the loss of provenance that creates the confused deputy.
Information flow enforcement requires preserving and checking source attributes before forwarding requests outside the trust boundary.
Input validation directly stops untrusted URLs from being accepted and fetched without destination checks.
Access enforcement directly stops a component from acting on forwarded requests without verifying original source authorizations.
Boundary protection limits and inspects external forwarding, reducing the ability of an intermediary to act as an unintended proxy.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper conveyance and verification of original identity assertions directly prevents loss of request source when forwarding.
Secure development practices directly include input validation and destination allow-listing that prevent SSRF.
Runtime monitoring of web applications and services can detect anomalous outbound requests indicative of SSRF.
Vulnerability identification processes can discover and record SSRF flaws in web applications.
Enforcing least-privilege authorizations on forwarded requests reduces confused-deputy abuse even if source identity is lost.
Network segmentation and egress controls can limit the damage from successful SSRF requests.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Access-control rules can limit which upstream identities may cause the product to act on their behalf, reducing confused-deputy risk.
Proper identity management ensures the original requester identity is preserved and validated before the product forwards requests.
Explicit access-rights assignment can restrict the product’s ability to act as an unintended proxy for external actors.
Operational threat data describing SSRF campaigns can be used to tighten outbound-request allow-lists and detection rules before attackers exploit them.
Privileged-access controls limit the rights the product may exercise on behalf of upstream callers, mitigating confused-deputy abuse.
Network-security controls can enforce source validation and prevent the product from blindly proxying traffic to external actors.