Critical GitLab AI Gateway RCE Vulnerability CVE-2024-4835 Patched

Key Takeaways

• GitLab has patched a critical remote code execution (RCE) vulnerability, CVE-2024-4835, in its self-hosted AI Gateway.
• The flaw, rated 9.9 CVSS, allows authenticated attackers with specific access to execute arbitrary commands.
• Self-hosted deployments supporting GitLab Duo AI features are affected; GitLab-hosted AI Gateways are already protected.
• Immediate upgrades to AI Gateway versions 19.2.4, 19.3.2, or 19.4.1 are strongly recommended for affected organizations.

Critical RCE Vulnerability Found in GitLab AI Gateway

GitLab has issued urgent security updates to address a severe vulnerability within its AI Gateway, which could enable authenticated attackers to achieve remote code execution (RCE). The flaw, identified as CVE-2024-4835, carries a critical CVSS score of 9.9 and specifically impacts self-hosted deployments that facilitate GitLab Duo AI capabilities.

In response, GitLab has released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to mitigate the issue. The company has strongly advised all customers operating affected self-hosted gateways to upgrade without delay. Prior to publicly releasing its security advisory, GitLab proactively contacted self-hosted AI Gateway customers, providing them with early guidance on the necessary updates.

Details of the GitLab AI Gateway Vulnerability

The core of the vulnerability lies in how the AI Gateway processes custom flow prompt templates. An authenticated user possessing Duo Agent Platform access could craft a malicious flow configuration. This specially designed input would then bypass the intended sandbox environment for the prompt template, leading to arbitrary command execution on the underlying AI Gateway system.

A sandbox is fundamentally designed to isolate and constrain template processing within a secure boundary. GitLab’s findings indicate that crafted input could effectively breach this boundary, escalating to command execution. This implies a more severe impact than merely manipulating AI responses; the integrity and availability of the service responsible for processing AI requests could be compromised.

The published CVSS vector characterizes this as a network-accessible attack with low complexity, requiring low privileges, and no user interaction. It assigns high impact ratings across confidentiality, integrity, and availability. It is crucial to note, however, that this is not an unauthenticated vulnerability; an attacker must possess a valid account with Duo Agent Platform access to exploit it.

GitLab has credited security researcher invisiblemeerkat for their responsible disclosure of this vulnerability. The official advisory does not include an exploit payload, specify the particular template engine involved, or indicate any active exploitation in the wild. These details are important as they confirm a critical security weakness without suggesting that attackers are currently leveraging it.

Affected AI Gateway releases encompass versions from 18.1.6 up to, but not including, 19.2.4; the 19.3 branch before 19.3.2; and the 19.4 branch prior to 19.4.1. These version ranges pertain specifically to the AI Gateway component itself. Administrators must verify their gateway deployment versions and should not solely rely on the version of their primary GitLab instance.

GitLab has already deployed the necessary fix to its own hosted AI Gateways. Consequently, customers utilizing GitLab.com, GitLab Dedicated, or GitLab Self-Managed instances that connect to a GitLab-hosted AI Gateway are automatically protected and do not need to take any action regarding this specific issue. However, organizations operating their own affected AI Gateways are solely responsible for installing the required updates.

This distinction is significant because GitLab’s self-hosted AI setup allows organizations to manage requests to their chosen AI model backends within their own secure environments. This gateway sandbox escape should not be confused with a previously covered GitLab Duo prompt injection vulnerability that involved source code exposure.

What You Should Do

• Upgrade Immediately: For self-hosted GitLab AI Gateway deployments, update to version 19.2.4, 19.3.2, or 19.4.1 without delay. Refer to GitLab’s AI Gateway installation and upgrade documentation for detailed instructions.
• Verify Deployment: After upgrading, ensure the correct patched image has been deployed, especially for Docker, Kubernetes, and Helm installations where image caching can sometimes prevent updates. Confirm the deployed image digest and run available health checks.
• Restrict Outbound Traffic: As a general hardening measure, restrict unnecessary outbound traffic from the AI Gateway while maintaining essential connections.
• Stay Informed: Regularly monitor GitLab’s security advisories for further updates and critical patches.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.