CVE-2021-22257
Description
An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. The route for /user.keys is not restricted on instances with public visibility disabled. This allows user enumeration on such instances.
Summary dbcve.org
GitLab versions 14.0.x before 14.0.9, 14.1.x before 14.1.4, and 14.2.x before 14.2.2 have an improper access control vulnerability where the /user.keys endpoint remains accessible even when public visibility is disabled on the instance. This allows unauthenticated attackers to enumerate valid usernames by querying this endpoint and receiving different responses for existing versus non-existing users.
Mitigation
Upgrade GitLab to version 14.0.9, 14.1.4, or 14.2.2 or later. Alternatively, configure web application firewall rules to restrict unauthenticated access to the /user.keys endpoint until upgrade can be performed.