CVE-2018-19570

Vulnerability

In GitLab CE/EE versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, the Markdown parser does not properly sanitize unrecognized HTML tags. This allows an attacker to insert a malicious ` tag followed by a markdown link with a javascript:` URL, which becomes clickable in the rendered output [1]. The vulnerability is present in any field that uses the Markdown editor, such as issue descriptions, comments, and snippet descriptions.

Exploitation

An attacker must have an account on the GitLab instance and be able to create or edit content using the Markdown editor (e.g., issues, comments, snippets). The attacker crafts a payload with an unrecognized HTML tag on one line, then a markdown link with a javascript: URL on the next line. The payload is submitted; when another user clicks the link (which may be disguised as an issue reference), the JavaScript executes in the context of the victim's session [1]. No elevated privileges are required beyond the ability to add Markdown content.

Impact

Successful exploitation leads to persistent cross-site scripting (XSS). The attacker can execute arbitrary JavaScript in the victim's browser within the GitLab domain. This can result in session hijacking, defacement, or access to sensitive information displayed on the page. The XSS is considered high severity (CVSS 8.8) due to the potential for account takeover and privilege escalation [1].

Mitigation

GitLab released fixed versions: 11.3.11, 11.4.8, and 11.5.1. Upgrade to these versions or later to remediate the vulnerability. No workarounds are documented; blocking unrecognized HTML tags via a web application firewall may provide partial protection but is not a complete solution. This CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing.