Executive brief
GitLab Community and Enterprise Editions are widely used platforms for software development and version control. A security flaw in the CI Lint API allows unauthorized external users to trick the GitLab server into making network requests to internal or restricted systems. This could lead to the exposure of sensitive internal data or provide a foothold for further attacks within a corporate network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in GitLab CE/EE within the CI Lint API component. The flaw stems from insufficient validation of user-supplied URLs or inputs when the API processes CI configuration linting requests. An unauthenticated remote attacker can exploit this by sending crafted requests to the CI Lint API, forcing the GitLab server to initiate outbound requests to internal network resources or external services. This can be used to bypass firewalls, scan internal networks, or access sensitive metadata services. Patches are available in versions 14.3.6, 14.4.4, and 14.5.2.
Affected products
- GitLab GitLab Community Edition 10.5 to <14.3.6, 14.4 to <14.4.4, 14.5 to <14.5.2
- GitLab GitLab Enterprise Edition 10.5 to <14.3.6, 14.4 to <14.4.4, 14.5 to <14.5.2
Timeline
- 2021-12-13: disclosed
- 2021-12-13: advisory
- 2026-02-03: kev added: Added to CISA KEV catalog due to evidence of active exploitation.