Server-Side Request Forgery (SSRF) in Gitlab Community Edition - CVE-2018-19571
Published: July 10, 2019 / Updated: June 17, 2021
Vulnerability identifier: #VU30988
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2018-19571
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote authenticated user to gain access to sensitive information.
GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks.
Affected software
Gitlab Community Edition
How to mitigate CVE-2018-19571
Install update from vendor's website.
Gitlab Community Edition - update to 11.5.1
Links to Public Exploits and PoC-codes
- Exploit #5624 - GitLab 11.4.7 - RCE (Authenticated) (June 17, 2021)
- Exploit #5629 - GitLab 11.4.7 - Remote Code Execution (Authenticated) (June 17, 2021)
- Exploit #5279 - gitlab-RCE-11.4.7 (GitLab 11.4.7 RCE exploit with different reverse shells. CVE-2018-19571 + CVE-2018-19585) (April 12, 2021)
- Exploit #5131 - edb-49263-fixed (Fixed version of the Python script to exploit CVE-2018-19571 and CVE-2018-19585 (GitLab 11.4.7 - Authenticated Remote Code Execution) that is available at https://www.exploit-db.com/exploits/49263 (Python 3.9).) (February 9, 2021)
- Exploit #4934 - gitlab_RCE (RCE for old gitlab version <= 11.4.7 & 12.4.0-12.8.1 and LFI for old gitlab versions 10.4 - 12.8.1) (December 16, 2020)
- Exploit #4931 - gitlab_RCE (RCE for old gitlab version <= 11.4.7) (December 16, 2020)