CVE-2023-0042

Vulnerability

An open redirect vulnerability exists in GitLab Pages affecting GitLab CE/EE versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 [1]. The auth endpoint in GitLab Pages does not properly restrict the domain parameter, allowing redirection to arbitrary protocols such as mailto://, javascript://, or custom URL schemes [1].

Exploitation

An attacker can craft a malicious URL like https://projects.gitlab.io/auth?domain=mailto://attacker-controlled.com?body=...&state=... and trick a victim into clicking it [1]. After the victim authenticates with GitLab, the browser is redirected to the attacker-specified protocol handler [1]. This can be used on mobile devices to trigger custom URL handlers that may exfiltrate authentication tokens or other sensitive data [1]. No additional privileges beyond the ability to host a GitLab Pages site are needed [1].

Impact

Successful exploitation allows an attacker to redirect users to arbitrary protocol handlers, potentially leading to information disclosure (e.g., authentication tokens leaked via mailto: body) or phishing attacks [1]. The impact is limited to user interaction and the availability of custom URL handlers on the target device [1].

Mitigation

GitLab has addressed this issue in versions 15.5.7, 15.6.4, and 15.7.2 [1]. Users should upgrade to these or later versions immediately [1]. No workarounds are available [1]. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog [1].