CVE-2021-39946

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in GitLab CE/EE versions 14.3 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2. The issue arises from improper neutralization of user input during the generation of HTML for emojis. Two sanitization bypasses were identified: one in the SyntaxHighlightFilter (server-side) and another in the gl-emoji custom element (frontend). The SyntaxHighlightFilter constructs HTML using unsanitized data-sourcepos attributes, while the gl-emoji element allows injection via the data-name attribute, bypassing the v-safe-html directive [1].

Exploitation

An authenticated attacker with the ability to create or edit issue comments can exploit this vulnerability. The attacker crafts a payload containing a ` tag with a malicious data-sourcepos attribute and a tag with a crafted data-name` attribute. When the comment is saved and later viewed by another user, the injected HTML is rendered, and the attacker's JavaScript executes in the context of the victim's browser. The exploit requires no additional user interaction beyond viewing the affected page. Self-managed GitLab instances are vulnerable; GitLab SaaS is not affected due to Content Security Policy (CSP) restrictions [1].

Impact

Successful exploitation results in stored XSS, allowing the attacker to execute arbitrary JavaScript in the browser of any user who views the malicious comment. This can lead to session hijacking, theft of sensitive data, or performing actions on behalf of the victim within the GitLab instance. The attacker gains the same privileges as the victim user.

Mitigation

GitLab has addressed this vulnerability in versions 14.3.7, 14.4.5, and 14.5.3. Users running affected versions should upgrade immediately. No workarounds are documented. GitLab SaaS instances are not vulnerable. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.