Executive brief
GitLab, a widely used platform for software development and collaboration, contains a vulnerability that allows unauthorized individuals to trick the server into making requests to internal systems. This could allow an attacker to bypass network security controls and access sensitive internal data or services that are not intended to be public. This issue is particularly serious as it can be exploited even on GitLab instances where user registration is disabled.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in GitLab affecting versions starting from 10.5. The flaw occurs when the 'requests to the internal network for webhooks' setting is enabled. An unauthenticated remote attacker can exploit this to force the GitLab server to send requests to internal network resources. This can be used to bypass firewall restrictions, perform internal port scanning, or interact with internal services that lack authentication. The vulnerability is exploitable even if user registration is disabled on the instance. Patches were released in versions 13.6.7, 13.7.7, and 13.8.4.
Affected products
- GitLab GitLab 10.5.0 to 13.6.7, 13.7.0 to 13.7.7, 13.8.0 to 13.8.4
Timeline
- 2021-06-11: disclosed: Initial NVD publication date
- 2026-02-18: kev added: Added to CISA Known Exploited Vulnerabilities catalog