CVE-2022-2497
Description
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. A malicious developer could exfiltrate an integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server.
Summary dbcve.org
In GitLab integrations, a developer-level user can modify an integration's URL to point to an attacker-controlled server. When GitLab makes authenticated requests to the integration (e.g., webhooks), it includes the integration's access token, which gets exfiltrated to the attacker's server.
Mitigation
Upgrade GitLab to version 15.0.5, 15.1.4, 15.2.1 or later. Additionally, audit existing integration configurations for unauthorized or suspicious URLs and restrict developer access to integration settings until patched.