Server-Side Request Forgery (SSRF) in GitLab

An attacker exploiting this SSRF vulnerability could leverage an authenticated GitLab user account to initiate requests to internal services that are not directly accessible from the outside world. This could include accessing internal APIs, databases, or other sensitive systems. The potential impact ranges from information disclosure (reading internal configuration files or data) to potentially gaining further access to internal networks if the targeted internal service has vulnerabilities. The blast radius is limited to the internal network accessible from the GitLab server, but the consequences of successful exploitation could be significant, especially if internal systems contain sensitive data or are critical to business operations. This vulnerability highlights the importance of proper input validation and output sanitization to prevent SSRF attacks.

Organizations utilizing GitLab CE or EE, particularly those with complex internal network architectures or exposed internal services, are at risk. Environments with legacy GitLab installations or those running older versions of GitLab are especially vulnerable. Shared hosting environments where multiple users share a GitLab instance should also be considered at higher risk.

• linux / server:

journalctl -u gitlab | grep -i "internal request"

• generic web:

curl -I <gitlab_url>/path/to/vulnerable/endpoint --connect-timeout 1 | grep -i "internal-ip"

1. 2025-09-12Disclosure

   disclosure

1. Reserviert2025-06-20
2. Veröffentlicht2025-09-12
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-6454 is to upgrade GitLab to version 18.3.2 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting outbound network access from the GitLab server using a Web Application Firewall (WAF) or proxy. Configure the WAF to block requests to internal IP addresses or specific internal services. Review and tighten access controls within the GitLab environment to limit the privileges of authenticated users. Monitor GitLab logs for suspicious outbound requests that may indicate exploitation attempts. After upgrading, confirm the fix by attempting to trigger the SSRF vulnerability with a crafted sequence and verifying that the request is blocked.