Server-Side Request Forgery (SSRF) in GitLab, Gitlab Community Edition

1) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU31317

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-8801

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to gain access to sensitive information.

GitLab Community and Enterprise Editions version 8.3 up to 10.x before 10.3 are vulnerable to SSRF in the Services and webhooks component.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 8.3 - 10.2.8

CPE2.3

• cpe:2.3:a:gitlab:gitlab:8.3:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab:8.3.0:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab:8.3.1:*:*:*:*:*:*:*

External links

https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG.md
https://gitlab.com/gitlab-org/gitlab-ce/issues/41642
https://hackerone.com/reports/301924

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.