CVE-2025-12073: GitLab CE/EE SSRF Vulnerability

CVE-2025-12073 Overview

CVE-2025-12073 is a Server-Side Request Forgery (SSRF) vulnerability in GitLab CE/EE that allows authenticated users to bypass security protections in the Git repository import functionality. Under certain conditions, attackers can exploit this flaw to make unauthorized requests to internal services, potentially exposing sensitive internal infrastructure and data.

Critical Impact

Authenticated attackers can bypass SSRF protections to interact with internal services that should not be accessible, potentially leading to internal network reconnaissance, access to metadata services, or exploitation of internal APIs.

Affected Products

• GitLab CE/EE versions 18.0 before 18.6.6
• GitLab CE/EE versions 18.7 before 18.7.4
• GitLab CE/EE versions 18.8 before 18.8.4

Discovery Timeline

• 2026-02-10 - GitLab releases security patch (versions 18.6.6, 18.7.4, 18.8.4)
• 2026-02-11 - CVE-2025-12073 published to NVD
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2025-12073

Vulnerability Analysis

This vulnerability is classified under CWE-918 (Server-Side Request Forgery). The flaw exists within GitLab's Git repository import functionality, which is designed to allow users to import repositories from external sources. The vulnerability allows authenticated users to craft malicious import requests that bypass the application's SSRF protection mechanisms.

SSRF vulnerabilities are particularly dangerous in cloud environments where attackers can potentially access cloud metadata services (such as AWS IMDSv1 at 169.254.169.254) or interact with internal microservices that trust requests originating from within the network perimeter. While this vulnerability requires authentication to exploit, reducing the attack surface, it still poses significant risks for organizations with untrusted or compromised user accounts.

Root Cause

The root cause of this vulnerability lies in insufficient validation and filtering of user-supplied URLs during the Git repository import process. GitLab implements SSRF protections to prevent users from importing repositories from internal network addresses, but certain edge cases or bypass techniques were not adequately covered by these protections. This allowed crafted URLs to slip through the validation logic and reach internal services.

Attack Vector

The attack is network-based and requires low-privilege authenticated access to the GitLab instance. An attacker would need to:

1. Authenticate to a vulnerable GitLab instance with standard user privileges
2. Navigate to the repository import functionality
3. Craft a malicious URL that bypasses the SSRF protection filters
4. Submit the import request, causing the GitLab server to make requests to internal services on behalf of the attacker

The vulnerability does not require user interaction beyond the attacker's own actions. The impact is primarily on integrity, as the attacker can cause the server to make unauthorized internal requests, potentially modifying data or configurations in connected internal services.

Detection Methods for CVE-2025-12073

Indicators of Compromise

• Unusual repository import requests targeting internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Import attempts targeting cloud metadata endpoints such as 169.254.169.254
• High volume of failed or suspicious import requests from a single user account
• Unexpected outbound connections from GitLab servers to internal services

Detection Strategies

• Monitor GitLab application logs for repository import events with unusual target URLs
• Implement network-level monitoring to detect GitLab server connections to internal services that should not be accessed during normal operations
• Review audit logs for patterns of import attempts that may indicate reconnaissance or exploitation
• Configure alerting for any import requests targeting private IP address ranges or localhost

Monitoring Recommendations

• Enable verbose logging for GitLab's repository import functionality
• Deploy network intrusion detection systems (IDS) to monitor for SSRF-like traffic patterns originating from GitLab servers
• Regularly audit user activity logs to identify suspicious import behaviors
• Monitor outbound traffic from GitLab instances for connections to cloud metadata services

How to Mitigate CVE-2025-12073

Immediate Actions Required

• Upgrade GitLab CE/EE to version 18.6.6, 18.7.4, or 18.8.4 depending on your current version branch
• Review recent repository import activity for signs of exploitation
• Audit user accounts with access to the repository import functionality
• Consider temporarily restricting repository import capabilities for untrusted users until patching is complete

Patch Information

GitLab has released patched versions that address this SSRF vulnerability. Organizations should upgrade to the following versions immediately:

• Version 18.6.6 for the 18.6.x branch
• Version 18.7.4 for the 18.7.x branch
• Version 18.8.4 for the 18.8.x branch

For complete patch details, refer to the GitLab Patch Release Announcement and the GitLab Issue Discussion. Additional technical details may be available in the HackerOne Report #3314987.

Workarounds

• Restrict access to the repository import feature using GitLab's role-based access controls
• Implement network segmentation to limit GitLab server access to internal services
• Configure egress filtering on GitLab servers to block connections to internal IP ranges from the import functionality
• Use Web Application Firewall (WAF) rules to inspect and block suspicious import requests

# Example: Network-level mitigation using iptables to restrict GitLab server outbound access
# Block GitLab server from accessing internal metadata service (example for AWS)
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Block access to internal network ranges from GitLab processes
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner git -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner git -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner git -j DROP