Access to resources on the GitLab server from GitLab services is not restricted

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_25
Category	System Configuration
Severity	LOW

Impact

The self-managed system is vulnerable to exploitation through its webhook functionality. User accounts can create webhooks that are executed from the system's own server. Malicious users may abuse this mechanism to send requests to services hosted on the local server or to internal network addresses accessible from it. Such activity could lead to unauthorized data exposure or manipulation of internal services.

Recommended Solution - Buildtime

Secure the self-managed GitLab server from malicious webhooks through the console or GitLab API.

Modify settings through the console

1. In the Admin Area, browse to the Settings page.
2. Disable the following settings under Outbound Requests:

   • Allow requests to the local network from webhooks and services
   • Allow requests to the local network from system hooks

Modify settings through the API

1. Refer to the instructions in the GitLab API documentation: https://docs.gitlab.com/ee/api/settings.html#change-application-settings.
2. Set the following settings to False:

   • Allow_local_requests_from_system_hooks
   • Allow_local_requests_from_web_hooks_and_services
   • Allow_local_requests_from_web_hooks_and_services

If required, allow system hooks access to specific resources on the GitLab server or the internal network by setting an allowlist through the console or GitLab API:

Set an allowlist through the console

1. In the Admin Area, browse to the Settings page > Network and expand the Outbound Requests section.
2. Insert the allowed entries in the text box.

📌 NOTE

• Separate entries by semicolons, commas or whitespaces (including newlines)
• Entries can take different formats, such as hostnames, IP addresses, and IP ranges, including IPv6. Ports can be included.

Set an allowlist through the API

1. Follow the instructions on the GitLab API documentation:https://docs.gitlab.com/ee/api/settings.html#change-application-settings.
2. Set the outbound_local_requests_whitelist setting to contain an array of allowed domains and/or addresses.

For additional information refer to the GitLab documentation: https://docs.gitlab.com/ee/security/webhooks.html#webhooks-and-insecure-internal-web-services.