CyberRota Analysis
AI-GeneratedGitLab versions prior to 44.11.3 are vulnerable to improper validation of Link header destinations during server pagination, enabling attackers to redirect requests containing sensitive credentials to malicious servers. This flaw poses a significant risk as it allows compromised GitLab servers to exfiltrate authentication data. Organizations using affected versions of GitLab should prioritize patching to mitigate the risk of credential theft.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructure to exfiltrate authentication credentials.