A critical Server-Side Request Forgery vulnerability in GitLab CE/EE allows authenticated attackers to perform unauthorized internal network requests, posing a significant risk to internal infrastructure.

This is a Server-Side Request Forgery (CWE-918) vulnerability where an authenticated user can inject crafted sequences to manipulate proxy environments. The flaw enables the attacker to force the server to make unintended requests to internal resources, effectively bypassing network access controls.

The ability to perform SSRF attacks can lead to the unauthorized disclosure of internal service data, interaction with non-public APIs, or the exploitation of internal services that rely on implicit trust. Given the CVSS score of 8.5, this high-severity flaw represents a substantial threat to organizational security, as an attacker could potentially pivot into internal network segments to access sensitive internal systems.

Immediate Action: Upgrade GitLab CE/EE instances to version 18.1.6, 18.2.6, 18.3.2, or higher immediately to resolve the vulnerable code path.

Proactive Monitoring: Monitor server access logs and proxy logs for unusual outbound connection patterns or requests directed toward internal IP addresses or restricted local services.

Compensating Controls: Implement strict egress filtering on the GitLab server to prevent unauthorized internal connections, and ensure the application is running in an isolated network segment with minimal privileges.

Public Exploit Available: Yes, a published proof-of-concept exists via the HackerOne report 3162711.

The severity of this SSRF vulnerability, combined with the presence of technical documentation, requires immediate attention from security and operations teams. We strongly recommend prioritizing the application of the vendor-provided patches to all affected GitLab instances to eliminate the risk of unauthorized internal network access and potential data exfiltration.