CVE-2021-22224
📋 TL;DR
This CSRF vulnerability in GitLab's GraphQL API allows attackers to execute mutations as authenticated users without their consent. It affects GitLab instances running versions 13.12 through 13.12.5 and 14.0 through 14.0.1. Attackers can perform actions on behalf of victims who visit malicious websites while authenticated to GitLab.
💻 Affected Systems
- GitLab Community Edition
- GitLab Enterprise Edition
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, data exfiltration, repository manipulation, or privilege escalation through GraphQL mutations executed as the victim.
Likely Case
Unauthorized modifications to repositories, issues, merge requests, or user settings through GraphQL mutations.
If Mitigated
Limited impact with proper CSRF protections, same-site cookies, and GraphQL mutation validation in place.
🎯 Exploit Status
Exploitation requires victim to be authenticated and visit malicious site. GraphQL mutations can be triggered via crafted web pages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 13.12.6, 14.0.2, or later
Vendor Advisory: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22224.json
Restart Required: Yes
Instructions:
1. Backup GitLab instance. 2. Update to GitLab 13.12.6+ or 14.0.2+ using package manager. 3. Run 'gitlab-ctl reconfigure'. 4. Restart GitLab services.
🔧 Temporary Workarounds
CSRF Token Enforcement
linuxEnable strict CSRF token validation for GraphQL API endpoints
Edit /etc/gitlab/gitlab.rb: gitlab_rails['graphql_csrf_protection'] = true
Run: gitlab-ctl reconfigure
🧯 If You Can't Patch
- Implement strict SameSite cookie policies and CSRF protection headers
- Restrict GraphQL API access through network controls or WAF rules
🔍 How to Verify
Check if Vulnerable:
Check GitLab version: cat /opt/gitlab/version-manifest.txt | grep gitlab-ce or gitlab-rake gitlab:env:infoCheck Version:
sudo gitlab-rake gitlab:env:info | grep VersionVerify Fix Applied:
Confirm version is 13.12.6+ or 14.0.2+ and test CSRF protection on GraphQL endpoints📡 Detection & Monitoring
Log Indicators:
- GraphQL mutation requests without CSRF tokens
- Unusual mutation patterns from single IPs
Network Indicators:
- POST requests to /api/graphql without referrer validation
- Cross-origin requests to GraphQL endpoints
SIEM Query:
source="gitlab" AND (uri_path="/api/graphql") AND (http_method="POST") AND NOT (csrf_token=*)🔗 References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22224.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/324397
- https://hackerone.com/reports/1122408
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22224.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/324397
- https://hackerone.com/reports/1122408
