CVE-2021-22213

Vulnerability

A cross-site leak vulnerability exists in the OAuth flow of all GitLab Community Edition (CE) and Enterprise Edition (EE) versions since 7.10 (released in 2015). The bug allows an attacker to leak an OAuth access token by getting the victim to visit a malicious page with Safari [1]. The issue is triggered when a user has previously authorized a third-party application (e.g., forum.gitlab.com). In subsequent login flows, a 302 redirect from gitlab.com to the third-party site occurs silently, carrying the access token in the URL. Safari's handling of SecurityPolicyViolationEvent exposed the redirect target URL via documentURI, enabling the leakage [1].

Exploitation

An attacker must first set up a malicious webpage that triggers a cross-origin redirect to an OAuth authorization endpoint for a pre-authorized app. The victim must be using Safari (versions 12.1.2 and 13.1.1 are confirmed; Safari 14 also works if "Prevent Cross-Site Tracking" is disabled) and must have previously authorized the target OAuth application [1]. When the victim visits the attacker's page, the browser performs a cross-origin redirect to https://gitlab.com/oauth/authorize?client_id=...&redirect_uri=.... The redirect then goes to the third-party site, and Safari generates a SecurityPolicyViolationEvent that contains the full redirect URL, including the access token, which the attacker can read via the event's documentURI property [1]. The attack requires zero user interaction (no clicks after page load) [1].

Impact

An attacker can steal the victim's OAuth access token for the targeted application. With this token, the attacker can impersonate the victim to that application, potentially gaining access to sensitive data or performing actions on behalf of the victim within the scope of the authorized application [1]. The attack does not require the victim to approve any additional prompts after the initial visit. The token is leaked in full, granting the same permissions the victim originally granted to the application [1].

Mitigation

GitLab addressed this vulnerability in versions 13.12.2, 13.11.5, and 13.10.5, released on 2021-06-08 [1]. Users should upgrade to one of these fixed versions or later. No workarounds are available for older versions. This vulnerability was reported via HackerOne (report #1089277) and is not listed in CISA's Known Exploited Vulnerabilities (KEV) as of this writing [1]. Safari users may also enable "Prevent Cross-Site Tracking" to mitigate the attack on Safari 14, but upgrading GitLab is the definitive remediation [1].