This critical SSRF vulnerability in GitLab Community and Enterprise Editions is being actively exploited in the wild, necessitating immediate patching to prevent unauthorized internal network access.

The flaw is a Server-Side Request Forgery (SSRF) located in the CI Lint API, which permits unauthenticated attackers to force the GitLab server to initiate requests to arbitrary internal or external targets.

The severity of this vulnerability is rated as critical with a CVSS score of 9.5, reflecting the high potential for unauthorized access to internal resources. A successful exploit allows attackers to bypass network perimeters, potentially leading to internal network scanning, the exposure of sensitive internal data, or the compromise of internal service credentials. Given the active exploitation observed in the wild, the risk of data breach and operational disruption is extremely high.

Immediate Action: Upgrade GitLab Community or Enterprise Edition instances to version 14.3.6, 14.4.4, or 14.5.2 immediately.

Proactive Monitoring: Review web server and application logs for suspicious requests directed at the CI Lint API that originate from unauthorized or external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block or inspect traffic targeting the CI Lint endpoint to mitigate potential exploit attempts while the update is being staged.

Public Exploit Available: Yes, public exploits are available for this vulnerability.

Due to confirmed active exploitation and the critical nature of this SSRF vulnerability, organizations must prioritize the application of the vendor-provided patches. Failure to update to the specified versions leaves the instance vulnerable to attackers who can pivot from the web interface into the internal network. Immediate remediation is required to secure the environment against ongoing exploitation campaigns.