Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in GitLab

Vulnerability

An open redirection vulnerability exists in GitLab Community Edition (CE) and Enterprise Edition (EE) versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, and all versions starting from 16.0 before 16.0.2. The bug is located in the NPM package API endpoint at /api/v4/projects/{project_id}/packages/npm, where HTTP response splitting is possible by injecting carriage return and line feed characters (%0d%0a) into the URL, allowing an attacker to overwrite the Location header with a controlled value [1].

Exploitation

An attacker can exploit this vulnerability by crafting a URL that includes %0d%0a followed by http:/ and a target domain. For example, the URL http://gitlab.example.com/api/v4/projects/{project_id}/packages/npm/%0d%0ahttp:/%2fexample.com?test will cause the server to split the HTTP response and redirect the user to http://example.com. The attacker only needs to lure a victim into clicking such a link; no authentication or special network position is required because the endpoint is publicly accessible for public projects [1].

Impact

Successful exploitation leads to open redirection, where a user can be redirected from a legitimate GitLab instance to an attacker-controlled website. This can be used for phishing attacks or other social engineering campaigns, as users may believe the destination is trustworthy. The impact is limited to redirection and does not directly result in code execution or data disclosure [1].

Mitigation

The vulnerability is fixed in GitLab versions 15.10.8, 15.11.7, and 16.0.2. Users running affected versions should upgrade immediately. No workaround is available for versions that are end-of-life or currently exposed. The fix involves filtering %0d and %0a characters in the vulnerable endpoint to prevent HTTP response splitting [1].