Improper Encoding or Escaping of Output in GitLab

Vulnerability

An HTML injection vulnerability exists in GitLab CE/EE versions 7.14 to 15.11.10, 16.0 to 16.0.6, and 16.1 to 16.1.1. It allows an attacker to inject HTML into the email address field. When the instance uses soft email confirmation settings, an attacker can register and change their email to include an HTML payload. If an administrator manually confirms the attacker's email, the HTML is rendered in the modal confirmation dialog. The vulnerable code is in the confirm_user_data method in app/helpers/users_helper.rb [1].

Exploitation

An attacker needs a GitLab instance with soft email confirmation enabled. The attacker registers an account, logs in, and changes their email to include an HTML payload (e.g., `). The attacker then waits for an administrator to manually confirm the email address. When the admin views the user's page and clicks "Confirm user", the modal dialog displays the unconfirmed email, which includes the injected HTML. The HTML is rendered, but tags like and ` are filtered out [1].

Impact

Successful exploitation allows the attacker to execute arbitrary HTML in the context of the admin's browser session. This could be used for phishing, defacement, or other client-side attacks. The impact is limited to the admin's browser and does not directly lead to server-side compromise, but it can be used to trick the admin into performing actions [1].

Mitigation

GitLab has released fixed versions: 15.11.10, 16.0.6, and 16.1.1. Users should upgrade to these versions or later. No workaround is available. The vulnerability is not listed in CISA KEV as of the publication date [1].