CVE-2021-22223: 
GitLab vulnerability analysis and mitigation

Client-Side code injection vulnerability (CVE-2021-22223) was discovered in GitLab CE/EE versions starting from 11.9. The vulnerability allows attackers to execute PUT requests on behalf of other users through a specially crafted feature flag name when victims click on a malicious link (GitLab Release).

The vulnerability stems from insufficient sanitization of Feature Flag descriptions in GitLab. The system was using DOMPurify to allow only <strong> tags and their DOM attributes, but this implementation was inadequate. Attackers could introduce arbitrary DOM attributes which, when combined with existing JavaScript functions in GitLab, could lead to unauthorized PUT requests. The vulnerability has a CVSS v3.1 score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (Ubuntu CVE).

The vulnerability could allow attackers to perform unauthorized actions on behalf of other users, including potential privilege escalation. In a demonstrated proof-of-concept, attackers could potentially escalate normal account privileges to administrator status through crafted feature flag descriptions (GitLab Issue).

The vulnerability requires user interaction, specifically clicking on a malicious link. The attack can be executed by creating a feature flag with a specially crafted description containing manipulated DOM attributes, which when combined with existing JavaScript functions, can trigger unauthorized PUT requests (GitLab Release).

The vulnerability has been patched in GitLab versions 14.0.2, 13.12.6, and 13.11.6. Organizations running affected versions are strongly recommended to upgrade to these or later versions immediately. The fix involves proper sanitization of DOM attributes in feature flag descriptions (GitLab Release).