Create CVE-2021-22175.yaml

[CodeStuffBreakThings]

Template / PR Information

• Created CVE-2021-22175.yaml
• References:
  • https://nvd.nist.gov/vuln/detail/CVE-2021-22175
  • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json
  • https://gitlab.com/gitlab-org/gitlab/-/issues/294178
  • https://hackerone.com/reports/1059596

/claim #11182

Template Validation

I've validated this template locally?

• YES
• NO

Additional Details (leave it blank if not applicable)

This vulnerability is exploitable when the impacted GitLab versions have the Allow requests to the local network from webhooks and integrations setting enabled.

In this detection template, the vulnerable GitLab instance sends an HTTP request to the GitLab Node Exporter which is bound to 127.0.0.1:9100 by default

Additional References:

• Nuclei Template Creation Guideline
• Nuclei Template Matcher Guideline
• Nuclei Template Contribution Guideline
• PD-Community Discord server

[algora-pbc]

👉 To complete your submission, sign up on Algora, link your Github account and submit the data for your PR.

[CodeStuffBreakThings]

I set up an instance of GitLab CE 13.8.3 with the "Allow requests to the local network from webhooks and integrations" setting enabled and was able to use the detection template to successfully exploit the SSRF vulnerability. Let me know if I need to provide any screenshots or packet captures, or if any other information is needed from me.
Thank you!

[DhiyaneshGeek]

Closing this since it was a duplicate of http/cves/2021/CVE-2021-22214.yaml, the bounty claim was raised by mistake sorry about this