CVE-2021-22175: GitLab Server-Side Request Forgery (SSRF) Vulnerability
GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.
Other sources
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable 'requests to the internal network for webhooks' in GitLab so webhooks cannot make requests to the internal network (preventing the SSRF condition when webhooks are allowed to reach internal addresses).
GitLab requests to the internal network for webhooks = disabled - Compensating control
Discontinue use of the product (GitLab) if mitigations are unavailable.
- Operational
Inventory GitLab instances running versions starting from 10.5 and verify whether 'requests to the internal network for webhooks' is enabled; for any instance (version >= 10.5) with the setting enabled, disable it.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-22175?
CVE-2021-22175 is classified as a high severity vulnerability due to its potential for server-side request forgery by unauthenticated attackers.
How do I fix CVE-2021-22175?
To fix CVE-2021-22175, upgrade GitLab to version 13.8.4 or later.
Which versions of GitLab are affected by CVE-2021-22175?
CVE-2021-22175 affects GitLab versions from 10.5.0 up to and including 13.8.3.
Can CVE-2021-22175 be exploited without authentication?
Yes, CVE-2021-22175 can be exploited by unauthenticated attackers even if registration is disabled on the GitLab instance.
What type of vulnerability is CVE-2021-22175?
CVE-2021-22175 is a server-side request forgery (SSRF) vulnerability.