Server‑Side Request Forgery (CVE‑2021‑39935) in GitLab Community & Enterprise Editions
What It Is – GitLab CE and EE expose a Server‑Side Request Forgery (SSRF) flaw in the CI Lint API that lets an unauthenticated attacker cause the server to issue arbitrary HTTP requests to internal resources.
Exploitability – Publicly disclosed; proof‑of‑concept code exists; CVSS v3.1 base score 7.5 (High). No known active exploit‑as‑a‑service, but the vulnerability is trivial to weaponise in a targeted attack.
Affected Products – GitLab Community Edition 13.12 – 14.9, GitLab Enterprise Edition 13.12 – 14.9 (all self‑hosted deployments).
Why It Matters for Trust & Control Assurance
- Control‑area test: Secure API handling and network‑boundary protection – a core control that underpins many frameworks (e.g., NIST CSF Identify/Protect).
- Evidence of due diligence: Detecting and patching SSRF requires continuous vulnerability scanning and documented remediation, providing audit‑ready proof that the organization monitors its software supply chain.
- Defensible audit trail: Demonstrating that the CI Lint endpoint is hardened (e.g., input validation, outbound‑request restrictions) satisfies reviewers looking for evidence of “secure configuration management” across the stack.
Recommended Actions
- Patch immediately – Apply GitLab 14.10.2 (or later) which resolves CVE‑2021‑39935.
- Validate remediation – Run authenticated scans against the CI Lint API to confirm the SSRF vector is closed.
- Enforce outbound‑request controls – Use network segmentation or egress firewalls to limit internal services reachable from GitLab runners.
- Document the fix – Capture patch‑deployment logs and scan results as control evidence for audit purposes.
Source: CISA KEV – CVE‑2021‑39935