CVE-2025-1072
📋 TL;DR
A denial-of-service vulnerability in GitLab CE/EE allows attackers to crash the service by importing maliciously crafted content via the Fogbugz importer. This affects all GitLab instances running vulnerable versions, potentially disrupting development workflows and CI/CD pipelines.
💻 Affected Systems
- GitLab Community Edition
- GitLab Enterprise Edition
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability requiring manual restart, disrupting all GitLab operations including code repositories, CI/CD pipelines, and issue tracking.
Likely Case
Temporary service disruption affecting import functionality and potentially causing broader system instability until restart.
If Mitigated
Minimal impact with proper access controls and monitoring; import attempts blocked or logged for investigation.
🎯 Exploit Status
Exploitation requires authenticated user access to import functionality. The vulnerability is well-documented in public disclosures.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 17.3.7, 17.4.4, or 17.5.2
Restart Required: Yes
Instructions:
1. Backup your GitLab instance. 2. Update to GitLab 17.3.7, 17.4.4, or 17.5.2 based on your current version. 3. Follow GitLab's upgrade documentation for your deployment method (Omnibus, Docker, Helm, etc.). 4. Restart the GitLab service.
🔧 Temporary Workarounds
Disable Fogbugz Importer
linuxTemporarily disable the vulnerable import functionality until patching is complete.
# Edit GitLab configuration
# For Omnibus: edit /etc/gitlab/gitlab.rb
# Add: gitlab_rails['import_sources'] = gitlab_rails['import_sources'] - ['fogbugz']
# Then run: gitlab-ctl reconfigure
Restrict Import Permissions
allLimit import capabilities to trusted administrators only.
# Via GitLab UI: Admin Area > Settings > General > Visibility and access controls
# Set 'Import sources' to 'Administrators only' or disable entirely
🧯 If You Can't Patch
- Implement strict access controls to limit import functionality to essential personnel only.
- Monitor import logs for suspicious activity and implement rate limiting on import endpoints.
🔍 How to Verify
Check if Vulnerable:
Check GitLab version via Admin Area > Overview or run: sudo gitlab-rake gitlab:env:info | grep 'GitLab version'Check Version:
sudo gitlab-rake gitlab:env:info | grep 'GitLab version'Verify Fix Applied:
Confirm version is 17.3.7, 17.4.4, or 17.5.2 or higher. Test import functionality with safe test data.📡 Detection & Monitoring
Log Indicators:
- Failed import attempts with malformed data
- Unusual import activity from non-admin users
- Service restart logs following import attempts
Network Indicators:
- Unusually large import payloads
- Multiple import requests from single source in short timeframe
SIEM Query:
source="gitlab.log" AND ("import" OR "fogbugz") AND ("error" OR "failed" OR "malformed")