CVE-2022-1417

Vulnerability

An improper access control vulnerability exists in GitLab Community Edition (CE) and Enterprise Edition (EE) affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9.4, and all versions starting from 14.10 before 14.10.1 [1]. The flaw resides in the Wiki functionality, where the Only Project Members visibility setting is not properly enforced when access is attempted via a CI_JOB_TOKEN in CI pipelines [1]. This token, typically used to grant temporary scoped access during CI jobs, bypasses the member-only restriction, allowing unauthorized cloning and reading of the wiki repository [1].

Exploitation

An attacker must have the ability to create a CI pipeline in an arbitrary project (any user with permission to run CI jobs on a publicly accessible or attacker-controlled project can do this) [1]. The attacker then defines a .gitlab-ci.yml file containing a job that executes git clone http://gitlab-ci-token:$CI_JOB_TOKEN@gitlab.com/.wiki.git [1]. When the pipeline runs, the CI_JOB_TOKEN associated with that specific job provides sufficient credentials to clone the target project's wiki repository, regardless of the wiki's visibility setting [1]. The attacker can then read all wiki content by listing files and viewing pages such as home.md [1]. No additional privileges or user interaction from the target project's members is required beyond the initial pipeline execution.

Impact

Successful exploitation allows an attacker who is not a member of the target project to access all contents of a Project Members-only Wiki [1]. This results in unauthorized disclosure of potentially sensitive information stored in the wiki, such as internal documentation, credentials, or project secrets. The attacker gains read access at the same level as a legitimate project member, but only through the CI pipeline context, not via the GitLab web interface. The CIA impact is limited to confidentiality, as the attacker cannot modify or delete wiki content.

Mitigation

The vulnerability is fixed in GitLab versions 14.8.6, 14.9.4, and 14.10.1 [1]. Users running affected versions should upgrade immediately to the nearest patched release. No workaround is available for unpatched versions, as the CI_JOB_TOKEN permissions are integral to pipeline functionality. It is important to note that this issue is a re-introduction of a previously patched bug and should be treated as a high-priority fix. This CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of writing.