CVE-2022-0154
📋 TL;DR
This Cross-Site Request Forgery (CSRF) vulnerability in GitLab allows attackers to trick authenticated users into unknowingly importing GitHub projects into their GitLab accounts. The attack requires user interaction but can lead to unauthorized project imports. All GitLab instances running affected versions are vulnerable.
💻 Affected Systems
- GitLab Community Edition
- GitLab Enterprise Edition
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
Attackers could import malicious GitHub repositories containing backdoors, malware, or sensitive data into victim's GitLab accounts, potentially leading to supply chain attacks or data exfiltration.
Likely Case
Attackers trick users into importing unwanted or malicious GitHub projects, cluttering repositories and potentially introducing vulnerable code.
If Mitigated
With proper CSRF protections and user awareness, impact is limited to minor inconvenience from unwanted imports.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link) but is straightforward once the user is authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.4.5, 14.5.3, or 14.6.2
Vendor Advisory: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0154.json
Restart Required: Yes
Instructions:
1. Backup your GitLab instance. 2. Update to GitLab 14.4.5, 14.5.3, or 14.6.2 depending on your current version. 3. Restart GitLab services. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable GitHub Import Feature
linuxTemporarily disable GitHub project imports to prevent exploitation.
gitlab-rails runner "ApplicationSetting.current.update(import_sources: ApplicationSetting.current.import_sources - ['github'])"
🧯 If You Can't Patch
- Implement strict CSRF protection headers and validate all import requests
- Educate users about phishing risks and suspicious GitHub import requests
🔍 How to Verify
Check if Vulnerable:
Check GitLab version via admin interface or command line. If version falls within affected ranges, system is vulnerable.Check Version:
sudo gitlab-rake gitlab:env:info | grep 'GitLab version'Verify Fix Applied:
Verify GitLab version is 14.4.5, 14.5.3, 14.6.2 or higher, and test GitHub import functionality with CSRF protection enabled.📡 Detection & Monitoring
Log Indicators:
- Unexpected GitHub import requests in application logs
- Multiple import requests from same user in short timeframe
Network Indicators:
- HTTP POST requests to /import/github without proper CSRF tokens
- External requests to GitHub API from unexpected sources
SIEM Query:
source="gitlab" AND ("import/github" OR "GitHub import") AND status=200🔗 References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0154.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/29580
- https://hackerone.com/reports/605576
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0154.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/29580
- https://hackerone.com/reports/605576
