CVE-2021-22175: GitLab Server-Side Request Forgery (SSRF) Vulnerability

This vulnerability is a server-side request forgery issue in GitLab that arises when webhook requests to the internal network are enabled. It matters because an attacker who can reach the affected webhook feature may be able to cause the GitLab instance to issue requests against internal systems that should not be reachable from outside.

How it works

CWE-918 describes server-side request forgery, in which an application accepts attacker-controlled input and uses it to construct an outbound request to an arbitrary destination. In this case the weakness is present when the webhook configuration permits requests that target the internal network. An attacker supplies a URL that points inside the network perimeter; the GitLab server then performs the request on the attacker’s behalf, potentially exposing internal services or data that the attacker could not reach directly.

Am I affected? How to find it in your systems

Inventory all GitLab installations, including self-managed instances and any GitLab-hosted projects that use webhooks. Examine webhook settings to determine whether requests to internal network addresses are permitted. Review application logs for outbound webhook activity that targets RFC 1918 or other internal address ranges. Exact version and configuration details must be confirmed against the vendor advisory.

How to remediate

Apply the vendor update referenced in the advisory. After patching, review webhook configurations and restrict them to explicitly allowed external destinations only. For the broader class of SSRF weaknesses, enforce allow-lists for outbound destinations, disable unnecessary webhook features, and ensure network controls prevent the application server from reaching internal resources that do not require it.

If you can't patch immediately

Apply mitigations according to vendor instructions. For cloud-hosted instances follow applicable BOD 22-01 guidance. Where mitigations cannot be applied, discontinue use of the affected product. Additional compensating steps include network segmentation that blocks the GitLab server from reaching internal hosts and monitoring outbound connections from the GitLab instance for unexpected internal targets.

If your data may have been exposed

Actively exploited vulnerabilities of this class can lead to unauthorized access and subsequent data exposure. You can run a free exposure scan of your email addresses to check whether they appear in known breach data.