CVE-2021-22246 – This vulnerability allows attackers to abuse Gi... (How to Fix)

Q: What is the severity of CVE-2021-22246?

CVE-2021-22246 has a CVSS score of 7.7 (HIGH). This vulnerability allows attackers to abuse GitLab's webhook feature to perform denial-of-service attacks by sending specially crafted payloads that cause excessive resource consumption. It affects GitLab instances running vulnerable versions before the patched releases. Organizations using self-hosted GitLab are primarily affected.

📋 TL;DR

This vulnerability allows attackers to abuse GitLab's webhook feature to perform denial-of-service attacks by sending specially crafted payloads that cause excessive resource consumption. It affects GitLab instances running vulnerable versions before the patched releases. Organizations using self-hosted GitLab are primarily affected.

💻 Affected Systems

Products:

GitLab Community Edition
GitLab Enterprise Edition

Versions: All versions before 14.0.2, 13.12.6, and 13.11.6

Operating Systems: All platforms running GitLab

Default Config Vulnerable: ⚠️ Yes

Notes: Affects all GitLab deployments with webhooks enabled, which is the default configuration. Both self-hosted and GitLab.com (already patched) were affected.

📦 What is this software?

Gitlab by Gitlab

GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...

Learn more about Gitlab →

Gitlab by Gitlab

GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...

Learn more about Gitlab →

Gitlab by Gitlab

GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...

Learn more about Gitlab →

Gitlab by Gitlab

GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...

Learn more about Gitlab →

Gitlab by Gitlab

GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...

Learn more about Gitlab →

Gitlab by Gitlab

GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...

Learn more about Gitlab →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service unavailability due to resource exhaustion, potentially affecting all GitLab functionality including repositories, CI/CD pipelines, and user access.

🟠

Likely Case

Degraded performance, intermittent service disruptions, and increased resource utilization affecting webhook processing and related features.

🟢

If Mitigated

Minimal impact with proper rate limiting, webhook validation, and monitoring in place to detect and block malicious payloads.

🌐 Internet-Facing: HIGH - Webhooks are typically accessible from external sources, making internet-facing instances directly vulnerable to exploitation.

🏢 Internal Only: MEDIUM - Internal attackers or compromised internal systems could still exploit the vulnerability, though attack surface is reduced.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires webhook access but doesn't require authentication to the webhook endpoint itself. Attackers need to know or guess webhook URLs, which are often predictable or discoverable.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 14.0.2, 13.12.6, or 13.11.6

Vendor Advisory: https://about.gitlab.com/releases/2021/04/28/security-release-gitlab-13-12-6-released/

Restart Required: Yes

Instructions:

1. Backup your GitLab instance. 2. Update to GitLab 14.0.2, 13.12.6, or 13.11.6 using your package manager. 3. Restart GitLab services. 4. Verify the update was successful.

🔧 Temporary Workarounds

Webhook Rate Limiting

all

Implement rate limiting on webhook endpoints to prevent excessive requests

# Configure in GitLab application settings or via reverse proxy
# Example nginx rate limiting: limit_req_zone $binary_remote_addr zone=webhook:10m rate=10r/s;

Webhook Access Restriction

linux

Restrict webhook access to trusted IP addresses only

# Configure firewall rules or web server access controls
# Example iptables: iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT

🧯 If You Can't Patch

Disable or restrict webhook functionality to essential use cases only
Implement network monitoring and alerting for unusual webhook activity patterns

🔍 How to Verify

Check if Vulnerable:

Check GitLab version with: sudo gitlab-rake gitlab:env:info | grep 'GitLab version'

Check Version:

sudo gitlab-rake gitlab:env:info | grep 'GitLab version'

Verify Fix Applied:

Confirm version is 14.0.2, 13.12.6, or 13.11.6 or higher

📡 Detection & Monitoring

Log Indicators:

Unusually high number of webhook requests
Increased error rates in webhook processing logs
Resource exhaustion warnings in system logs

Network Indicators:

Spike in traffic to webhook endpoints
Unusual patterns in webhook payload sizes or frequencies

SIEM Query:

source="gitlab.logs" AND ("webhook" AND ("error" OR "timeout" OR "resource")) | stats count by src_ip

📊 Metadata

CVE ID: CVE-2021-22246

CVSS v3 Score: 7.7 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

CWE: CWE-770

Published: August 20, 2021

Last Updated: November 21, 2024

🔗 References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22246.json Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/280633 Broken Link
https://hackerone.com/reports/1029269 Permissions Required,Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22246.json Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/280633 Broken Link
https://hackerone.com/reports/1029269 Permissions Required,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-22246, you might also want to check these: