CVE-2021-22168 : Security Advisory and Response

A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8.

Understanding CVE-2021-22168

This CVE impacts GitLab versions >=12.8, <13.5.6, >=13.6.0, <13.6.4, and >=13.7.0, <13.7.2.

What is CVE-2021-22168?

CVE-2021-22168 is a regular expression denial of service vulnerability found in the NuGet API that affects multiple versions of GitLab, allowing attackers to trigger a denial of service condition.

The Impact of CVE-2021-22168

The impact of this vulnerability is rated as MEDIUM with a CVSS base score of 4.3. It could lead to uncontrolled resource consumption in GitLab instances.

Technical Details of CVE-2021-22168

This vulnerability has a CVSS score of 4.3, with low attack complexity and network attack vector. It requires low privileges and user interaction, with an availability impact of LOW.

Vulnerability Description

The vulnerability stems from uncontrolled resource consumption in GitLab due to a regular expression denial of service issue in the NuGet API.

Affected Systems and Versions

GitLab versions >=12.8, <13.5.6, >=13.6.0, <13.6.4, and >=13.7.0, <13.7.2 are impacted by this CVE.

Exploitation Mechanism

Attackers can exploit this vulnerability by sending specially crafted requests to the NuGet API, causing a denial of service by overwhelming the system with regular expression processing.

Mitigation and Prevention

It is crucial to take immediate steps to secure GitLab instances and prevent exploitation of this vulnerability.

Immediate Steps to Take

Update GitLab to versions that include the relevant security patches.
Monitor system resource usage for any unusual spikes that could indicate a denial of service attack.

Long-Term Security Practices

Regularly update GitLab and other software components to patch known vulnerabilities.
Implement network controls and rate limiting to mitigate denial of service risks.

Patching and Updates

Ensure timely application of security updates provided by GitLab to address CVE-2021-22168 and other potential vulnerabilities.