Description
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | >=10.5, <13.10.5, >=13.11, <13.11.5, >=13.12, <13.12.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | gitlab | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 4 repositories
-
ZZ-SOCMAP/CVE-2021-22214 ★ 10 · Nov 1, 2021
Gitlab CI Lint API未授权 SSRF漏洞 CVE-2021-22214
-
kh4sh3i/GitLab-SSRF-CVE-2021-22214 ★ 3 · Jan 4, 2022
POC for CVE-2021-22214: Gitlab SSRF
-
aaminin/CVE-2021-22214 ★ 1 · Jun 22, 2021
Gitlab CI Lint API未授权 SSRF漏洞 (CVE-2021-22214)
-
Vulnmachines/gitlab-cve-2021-22214 ★ 0 · Jun 29, 2021
Gitlab SSRF
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Gitlab CE/EE 10.5 - Server-Side Request Forgery http/cves/2021/CVE-2021-22214.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.