Cross-Site Scripting in GitLab Mermaid Diagram Rendering

Executive Summary

This vulnerability in GitLab CE/EE affects versions from 17.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1. It allows an authenticated user to execute arbitrary JavaScript in another user's browser. This happens because GitLab improperly sanitizes entity-encoded content in Mermaid diagrams, which can be exploited to inject malicious scripts.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to cross-site scripting (XSS) attacks where an attacker can run arbitrary JavaScript in the context of another user's browser. This can result in unauthorized actions performed on behalf of the user, theft of sensitive information such as session tokens, or other malicious activities that compromise user security and privacy.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your GitLab CE/EE instance to a fixed version. Specifically, update to version 18.8.7 or later if you are using the 18.8 series, 18.9.3 or later if using the 18.9 series, or 18.10.1 or later if using the 18.10 series.

This vulnerability affects all versions from 17.7 before the fixed versions mentioned above and could allow an authenticated user to execute arbitrary JavaScript in a user's browser due to improper sanitization of entity-encoded content in Mermaid diagrams.

Useful 0 Not Useful 0