An authenticated user can trigger stored cross-site scripting in GitLab CE/EE due to insufficient input validation within the Kubernetes proxy component, creating a risk of unauthorized actions.

This is a stored cross-site scripting vulnerability (CWE-79) stemming from improper input validation in the Kubernetes proxy functionality. It requires an authenticated user to successfully execute the attack.

Successful exploitation allows an authenticated attacker to execute arbitrary scripts in the context of other users or administrators. Given the CVSS score of 7.7, this represents a high-severity risk that could lead to session hijacking, unauthorized data access, or the performance of administrative actions on behalf of compromised accounts, potentially compromising the integrity of the development environment.

Immediate Action: Upgrade to GitLab versions 18.3.6, 18.4.4, 18.5.2, or later to apply the necessary input validation patches.

Proactive Monitoring: Review application access logs for suspicious patterns originating from the Kubernetes proxy interface, particularly those involving unusual script tags or character sequences.

Compensating Controls: Implement a strict Content Security Policy (CSP) to mitigate the impact of potential cross-site scripting attacks and utilize a Web Application Firewall (WAF) to filter malicious payloads targeting the Kubernetes proxy.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the HackerOne report linked in the vulnerability references.

The vulnerability presents a significant risk to the security of the GitLab environment by allowing authenticated users to bypass input controls. Security teams must treat this as a high-priority item and coordinate the required version upgrades immediately to ensure the integrity of user sessions and the underlying infrastructure.