CVE-2018-19585

Vulnerability

GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 contain a CRLF injection vulnerability in Project Mirroring when using the Git protocol [1]. This allows an attacker to inject carriage return and line feed characters into the mirroring process.

Exploitation

An attacker with the ability to configure project mirroring (e.g., a project owner or maintainer) can inject CRLF sequences into the mirror configuration or during the Git protocol exchange. The exact exploitation steps are not disclosed in the available references, but the vulnerability is triggered when the Git protocol processes specially crafted input.

Impact

Successful exploitation enables CRLF injection, which can lead to HTTP response splitting, header injection, or bypass of security controls. The attacker may gain the ability to inject arbitrary headers into responses or manipulate the mirroring process to achieve further compromise.

Mitigation

GitLab released fixed versions: 11.3.11, 11.4.8, and 11.5.1. Users should upgrade to these versions or later. No workaround is documented. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.