CVE-2021-22171 – This vulnerability in GitLab Pages allows attac... (How to Fix)

Q: What is the severity of CVE-2021-22171?

CVE-2021-22171 has a CVSS score of 7.3 (HIGH). This vulnerability in GitLab Pages allows attackers to steal API tokens through insufficient authentication parameter validation. Attackers can craft malicious links that, when clicked by authenticated users, expose their API tokens. Affects GitLab 11.5+ with GitLab Pages enabled.

📋 TL;DR

This vulnerability in GitLab Pages allows attackers to steal API tokens through insufficient authentication parameter validation. Attackers can craft malicious links that, when clicked by authenticated users, expose their API tokens. Affects GitLab 11.5+ with GitLab Pages enabled.

💻 Affected Systems

Products:

GitLab
GitLab Pages

Versions: GitLab 11.5 through 13.9.4, 13.10 through 13.10.3, and 13.11 through 13.11.1

Operating Systems: All platforms running GitLab

Default Config Vulnerable: ⚠️ Yes

Notes: Requires GitLab Pages to be enabled and configured. Self-managed GitLab instances are affected; GitLab.com was patched before disclosure.

📦 What is this software?

Gitlab by Gitlab

GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...

Learn more about Gitlab →

Gitlab by Gitlab

GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...

Learn more about Gitlab →

Gitlab by Gitlab

GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...

Learn more about Gitlab →

Gitlab by Gitlab

GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...

Learn more about Gitlab →

Gitlab by Gitlab

GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...

Learn more about Gitlab →

Gitlab by Gitlab

GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...

Learn more about Gitlab →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete account takeover, unauthorized access to private repositories, data exfiltration, and lateral movement within GitLab infrastructure.

🟠

Likely Case

API token theft leading to unauthorized repository access, code modification, and potential data leakage.

🟢

If Mitigated

Limited impact with proper network segmentation, API token rotation policies, and user awareness training.

🌐 Internet-Facing: HIGH - GitLab Pages are often internet-facing, making exploitation trivial via phishing.

🏢 Internal Only: MEDIUM - Internal users could still be targeted via internal phishing campaigns.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires user interaction (clicking malicious link) but is straightforward once the link is crafted. Public exploit details available in HackerOne report.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: GitLab 13.9.4, 13.10.3, 13.11.1 and later

Vendor Advisory: https://about.gitlab.com/releases/2021/03/04/security-release-gitlab-13-9-4-released/

Restart Required: Yes

Instructions:

1. Backup GitLab instance. 2. Update GitLab to patched version using official upgrade instructions. 3. Restart GitLab services. 4. Verify patch application.

🔧 Temporary Workarounds

Disable GitLab Pages

linux

Temporarily disable GitLab Pages feature if not required

gitlab_rails['pages_enabled'] = false
sudo gitlab-ctl reconfigure

Restrict Pages Access

linux

Configure GitLab Pages to only serve content to authenticated users

gitlab_rails['pages_access_control'] = true
sudo gitlab-ctl reconfigure

🧯 If You Can't Patch

Implement strict network controls to limit GitLab Pages exposure to trusted networks only
Enforce mandatory API token rotation policies and user security awareness training about phishing risks

🔍 How to Verify

Check if Vulnerable:

Check GitLab version: if between 11.5-13.9.3, 13.10.0-13.10.2, or 13.11.0, and GitLab Pages is enabled, system is vulnerable.

Check Version:

sudo gitlab-rake gitlab:env:info | grep 'Version:'

Verify Fix Applied:

Verify GitLab version is 13.9.4+, 13.10.3+, or 13.11.1+ and test that malicious link patterns no longer expose tokens.

📡 Detection & Monitoring

Log Indicators:

Unusual API token usage patterns
Multiple failed authentication attempts followed by successful token-based access
GitLab Pages access logs showing suspicious referrer headers

Network Indicators:

Outbound connections from GitLab server to unexpected external IPs using API tokens
Unusual traffic patterns to GitLab Pages endpoints

SIEM Query:

source="gitlab" AND (event="api_token_created" OR event="pages_access") AND user_agent CONTAINS "malicious" OR referrer CONTAINS "suspicious_domain"

📊 Metadata

CVE ID: CVE-2021-22171

CVSS v3 Score: 7.3 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CWE: CWE-287

Published: January 15, 2021

Last Updated: November 21, 2024

🔗 References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22171.json Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-pages/-/issues/262 Broken Link
https://hackerone.com/reports/718460 Permissions Required,Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22171.json Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-pages/-/issues/262 Broken Link
https://hackerone.com/reports/718460 Permissions Required,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-22171, you might also want to check these: