CVE-2021-39870 : What You Need to Know

In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a crafted API call.

Understanding CVE-2021-39870

A vulnerability in GitLab affecting versions between 11.11 and 14.3.1, allowing attackers to bypass security settings.

What is CVE-2021-39870?

The vulnerability allows bypassing of security settings in GitLab CE/EE through a crafted API call.

The Impact of CVE-2021-39870

CVSS Base Score: 4.3 (Medium)
Attack Vector: Network
Attack Complexity: Low
Integrity Impact: Low
Privileges Required: Low
No user interaction needed
Exploit Scope: Unchanged
Availability Impact: None
No confidentiality impact

Technical Details of CVE-2021-39870

A detailed look at the technical aspects of the vulnerability.

Vulnerability Description

The vulnerability permits an attacker to circumvent security settings using a specific API call.

Affected Systems and Versions

Affected Product: GitLab
Affected Versions:
=11.11, <14.1.7

=14.2, <14.2.5

=14.3, <14.3.1

Exploitation Mechanism

The vulnerability is exploited by making a crafted API call to GitLab, allowing an attacker to bypass security controls.

Mitigation and Prevention

Steps to protect systems from CVE-2021-39870.

Immediate Steps to Take

Update GitLab to version 14.3.1 or higher
Review and adjust security settings
Monitor API requests for suspicious activities

Long-Term Security Practices

Regularly update GitLab and monitor for security patches
Implement least privilege access controls
Conduct security trainings for development and IT teams

Patching and Updates

Apply patches provided by GitLab promptly
Stay informed about CVEs and security best practices