CVE-2023-3900: GitLab CE/EE DoS Vulnerability

CVE-2023-3900 Overview

CVE-2023-3900 is a denial of service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions starting from 16.1 before 16.1.3 and all versions starting from 16.2 before 16.2.2. An attacker can supply an invalid start_sha value on the merge requests page, which prevents the Changes tab from loading. This disrupts code review workflows and impacts the availability of merge request functionality. The vulnerability is categorized under [CWE-1287] for improper validation of specified type of input.

Critical Impact
Unauthenticated attackers can exploit this issue over the network to trigger a denial of service condition on the merge requests Changes tab, disrupting development workflows.

Affected Products

GitLab Community Edition (CE) versions 16.1 through 16.1.2
GitLab Enterprise Edition (EE) versions 16.1 through 16.1.2
GitLab CE/EE versions 16.2 through 16.2.1

Discovery Timeline

2023-08-02 - CVE-2023-3900 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-3900

Vulnerability Analysis

The vulnerability resides in the merge request handling logic within GitLab CE/EE. When a user accesses a merge request, the application processes a start_sha parameter to determine the commit range for the Changes tab. The code fails to properly validate this parameter before use. Supplying an invalid start_sha value causes the Changes tab to fail loading, producing a denial of service condition for that merge request view. The issue is tracked in the GitLab Issue Report and was originally reported through the HackerOne Vulnerability Report.

Root Cause

The root cause is improper validation of the start_sha input parameter on the merge requests page. The application does not verify that the supplied SHA corresponds to a valid commit before attempting to render the Changes view. This maps to [CWE-1287], improper validation of specified type of input to a function.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker provides a crafted start_sha query parameter when requesting a merge request's Changes tab. The malformed input triggers a backend processing failure that prevents the tab from rendering for subsequent access. No code execution or data disclosure occurs — only availability of the affected functionality is impacted.

No verified public proof-of-concept code is available. See the GitLab Issue Report for technical details.

Detection Methods for CVE-2023-3900

Indicators of Compromise

Repeated HTTP requests to merge request endpoints containing malformed or non-existent start_sha query parameter values.
GitLab application logs showing failed rendering of the Changes tab on merge request pages.
User reports of merge request Changes tabs failing to load across multiple projects.

Detection Strategies

Inspect web server access logs for anomalous start_sha parameter values containing invalid hex strings or unexpected characters.
Correlate spikes in 5xx responses from /merge_requests/*/diffs and related endpoints with specific source IP addresses.
Monitor GitLab Rails application error logs for exceptions tied to merge request diff rendering.

Monitoring Recommendations

Forward GitLab production logs and web proxy logs to a centralized SIEM for query-parameter analysis.
Alert on repeated requests from the same source containing varying start_sha values within short time windows.
Track baseline error rates for merge request endpoints and trigger alerts on deviations.

How to Mitigate CVE-2023-3900

Immediate Actions Required

Upgrade GitLab CE/EE to version 16.1.3, 16.2.2, or later as soon as feasible.
Restrict network access to GitLab instances to trusted users and authenticated VPN connections where possible.
Review web access logs for prior exploitation attempts referencing malformed start_sha values.

Patch Information

GitLab released fixed versions 16.1.3 and 16.2.2 that address the input validation flaw. Self-managed GitLab administrators should review the GitLab Issue Report and apply the upgrade following standard GitLab upgrade procedures. GitLab.com SaaS instances are patched by GitLab directly.

Workarounds

Deploy a web application firewall (WAF) rule to validate the start_sha query parameter format against a 40-character hexadecimal pattern before requests reach GitLab.
Limit anonymous access to merge request pages on public-facing GitLab instances until the patch is applied.
Rate-limit requests to merge request diff endpoints to reduce the impact of repeated invalid start_sha submissions.

bash

# Example: upgrade GitLab Omnibus on Debian/Ubuntu to a patched version
sudo apt-get update
sudo apt-get install gitlab-ce=16.2.2-ce.0
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart