CVE-2021-22175
GitLab Server-Side Request Forgery (SSRF) Vulnerability
Description
CVE-2021-22175 is a server-side request forgery (SSRF) vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) affecting all versions starting from 10.5. The flaw resides in the webhook functionality, specifically when requests to the internal network for webhooks are enabled. An unauthenticated attacker can exploit this vulnerability to forge server-side requests that reach internal services, potentially exfiltrating sensitive data from systems behind the firewall. The vulnerability carries a CVSS v3.1 base score of 6.8 (Medium severity) with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N, reflecting network-based access with high attack complexity but no required privileges or user interaction, and a changed scope with high confidentiality impact. GitLab has released patched versions 13.6.7, 13.7.7, and 13.8.4. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 11, 2026, underscoring its active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| gitlab | gitlab | >= 10.5.0, < 13.6.7; >= 13.7.0, < 13.7.7; >= 13.8.0, < 13.8.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json(Vendor Advisory)
- https://gitlab.com/gitlab-org/gitlab/-/issues/294178(Exploit, Issue Tracking, Vendor Advisory)
- https://hackerone.com/reports/1059596(Permissions Required, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22175(US Government Resource)
Weakness Type
CWE-918: Server-Side Request Forgery (SSRF)
This vulnerability is classified under CWE-918, which describes a condition where an application can be induced to send crafted requests to unintended destinations from the server side. In the case of CVE-2021-22175, the GitLab webhook subsystem fails to adequately restrict the destinations of outbound HTTP requests when internal network access for webhooks is enabled. An attacker who provides a malicious URL as a webhook target can cause the GitLab server to issue requests to internal network resources, including metadata endpoints, internal APIs, or other services not meant to be publicly accessible. SSRF vulnerabilities are particularly dangerous in cloud-hosted environments, where access to instance metadata services (such as AWS IMDS at 169.254.169.254) can yield temporary credentials and facilitate lateral movement.
Impact Analysis
Confidentiality is the primary concern with CVE-2021-22175. Because the CVSS vector indicates a changed scope (S:C) with high confidentiality impact (C:H), the attacker can read data from systems that are not the vulnerable component itself. An unauthenticated attacker exploiting this SSRF can probe and retrieve data from internal services, cloud metadata endpoints, and other network-accessible resources behind the GitLab server's firewall. This may include source code repositories, CI/CD secrets, internal API keys, and infrastructure credentials.
Integrity and Availability are not directly impacted according to the CVSS assessment (I:N, A:N). However, SSRF vulnerabilities can serve as a stepping stone for further attacks. If an attacker gains access to internal credentials or configuration data through the SSRF, they may leverage that information for secondary exploits that affect integrity or availability.
Operational Impact is significant for organizations relying on GitLab for their software development lifecycle. The vulnerability is exploitable without authentication and without user interaction, which lowers the barrier for mass exploitation. Its inclusion in the CISA KEV catalog with an EPSS score of 0.7349 (98.78th percentile) indicates that exploitation is widespread and highly probable. Organizations running unpatched GitLab instances with webhooks enabled to internal networks face substantial risk of data exfiltration.
Exploit Maturity
CVE-2021-22175 has confirmed active exploitation in the wild, as evidenced by its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.7349 places it in the 98.78th percentile, meaning this vulnerability is exploited at a significantly higher rate than the vast majority of known vulnerabilities. The high attack complexity (AC:H) in the CVSS vector suggests that exploitation requires certain preconditions to be met, specifically that internal network access for webhooks must be enabled in the GitLab configuration, but once that condition is satisfied, exploitation is straightforward for an unauthenticated attacker.
SSRF exploitation techniques are well-understood and widely documented in the security community. Attackers commonly use SSRF vulnerabilities to reach cloud metadata services, internal REST APIs, and administration interfaces. The combination of no authentication requirement (PR:N) and no user interaction (UI:N) makes this vulnerability particularly attractive for automated exploitation campaigns. CISA has set a remediation deadline of March 11, 2026, reflecting the urgency of addressing this vulnerability in federal and critical infrastructure environments.
Remediation
Immediate Patching is the most effective remediation. Organizations should upgrade GitLab to version 13.6.7, 13.7.7, or 13.8.4 (or any later release), depending on their current version branch. The patched versions introduce proper validation and restriction of webhook request destinations to prevent SSRF exploitation.
Disable Internal Network Webhook Requests as a temporary mitigation if immediate patching is not possible. In GitLab's administration settings, disable the option that allows webhooks to make requests to the local network. This removes the primary attack vector while patching is scheduled.
Network Segmentation provides defense in depth. Ensure that the GitLab server cannot reach sensitive internal services, cloud metadata endpoints, or administrative interfaces from its network segment. Use firewall rules or security groups to restrict outbound connections from the GitLab host to only necessary destinations.
Monitor for Exploitation Indicators by reviewing webhook configurations for suspicious entries pointing to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254) or localhost addresses. Audit GitLab server logs for unusual outbound HTTP requests that may indicate active SSRF exploitation attempts.
Enforce Webhook URL Allowlists after patching to ensure that webhooks can only target pre-approved external domains or IP ranges, reducing the attack surface for potential future SSRF vulnerabilities.
Technical Details
CVE-2021-22175 targets the webhook processing functionality in GitLab CE/EE. When a GitLab instance is configured to allow webhooks to make requests to the internal (local) network, the server processes webhook URLs without sufficient validation of the request destination. The vulnerable code path accepts user-supplied URLs and issues HTTP requests from the server side, enabling an attacker to direct those requests to arbitrary internal resources.
Attack Vector and Prerequisites: The vulnerability is exploitable over the network (AV:N) and requires no authentication (PR:N) or user interaction (UI:N). The attack complexity is rated high (AC:H) because the GitLab instance must have internal network webhook requests enabled, a non-default configuration option. However, many production deployments enable this setting to integrate with internal CI/CD pipelines, monitoring systems, and other internal services.
Affected Versions: All GitLab versions from 10.5 up to (but not including) 13.6.7, from 13.7.0 up to 13.7.7, and from 13.8.0 up to 13.8.4 are vulnerable. The fix was applied across all three active release branches simultaneously.
SSRF Exploitation Mechanics: An attacker crafts a webhook configuration with a URL pointing to an internal resource. When the webhook is triggered, GitLab's server sends an HTTP request to the specified URL, effectively acting as a proxy for the attacker. Common targets include cloud provider metadata services (e.g., http://169.254.169.254/latest/meta-data/), internal APIs, database administration interfaces, and other services accessible from the GitLab server's network position. The response data may be returned to the attacker or can be exfiltrated through DNS-based or timing-based out-of-band techniques.
Frequently Asked Questions
Is CVE-2021-22175 actively exploited in the wild?
Yes. CVE-2021-22175 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. Its EPSS score of 0.7349 (98.78th percentile) further indicates a very high probability of exploitation.
What versions of GitLab are affected by CVE-2021-22175?
All GitLab CE and EE versions from 10.5 are affected. The vulnerability is fixed in versions 13.6.7, 13.7.7, and 13.8.4. Organizations should upgrade to these versions or any later release to remediate the issue.
Can CVE-2021-22175 be exploited without authentication?
Yes. The vulnerability requires no authentication (PR:N) and no user interaction (UI:N). However, the GitLab instance must have internal network webhook requests enabled for exploitation to succeed, which is why the attack complexity is rated as high (AC:H).
What data can an attacker access through this SSRF vulnerability?
An attacker can potentially access any resource reachable from the GitLab server's network position, including cloud metadata endpoints, internal APIs, administration interfaces, and other services behind the firewall. The CVSS vector indicates high confidentiality impact with a changed scope, meaning data from systems other than GitLab itself may be exposed.
Is this vulnerability related to ransomware campaigns?
CISA lists the ransomware association as "Unknown" for this CVE. While the vulnerability itself is an information disclosure via SSRF rather than a direct code execution flaw, the credentials or secrets obtained through exploitation could facilitate subsequent attacks including ransomware deployment.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.