> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/system-configurations/appsec-cicd-25.md). # Access to resources on the GitLab server from GitLab services is not restricted ## Rule Details | | | | --------------------- | -------------------- | | Cortex AppSec Rule ID | APPSEC\_CICD\_25 | | Category | System Configuration | | Severity | LOW | ## Impact The self-managed system is vulnerable to exploitation through its webhook functionality. User accounts can create webhooks that are executed from the system's own server. Malicious users may abuse this mechanism to send requests to services hosted on the local server or to internal network addresses accessible from it. Such activity could lead to unauthorized data exposure or manipulation of internal services. ## Recommended Solution - Buildtime Secure the self-managed GitLab server from malicious webhooks through the console or GitLab API. ### Modify settings through the console 1. In the **Admin Area**, browse to the **Settings** page. 2. Disable the following settings under Outbound Requests: * **Allow requests to the local network from webhooks and services** * **Allow requests to the local network from system hooks** ### Modify settings through the API 1. Refer to the instructions in the GitLab API documentation: . 2. Set the following settings to **False**: * **Allow\_local\_requests\_from\_system\_hooks** * **Allow\_local\_requests\_from\_web\_hooks\_and\_services** * **Allow\_local\_requests\_from\_web\_hooks\_and\_services** If required, allow system hooks access to specific resources on the GitLab server or the internal network by setting an **allowlist** through the console or GitLab API: ### Set an allowlist through the console 1. In the **Admin Area**, browse to the **Settings** page > **Network** and expand the **Outbound Requests** section. 2. Insert the allowed entries in the text box. **📌 NOTE** * Separate entries by semicolons, commas or whitespaces (including newlines) * Entries can take different formats, such as hostnames, IP addresses, and IP ranges, including IPv6. Ports can be included. ### Set an allowlist through the API 1. Follow the instructions on the GitLab API documentation:. 2. Set the **outbound\_local\_requests\_whitelist** setting to contain an array of allowed domains and/or addresses. For additional information refer to the GitLab documentation: . --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/system-configurations/appsec-cicd-25.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.