CVE-2022-0427: 
GitLab vulnerability analysis and mitigation

CVE-2022-0427 is a high severity vulnerability affecting GitLab CE/EE versions since 14.5 that was discovered in February 2022. The vulnerability involves missing sanitization of HTML attributes in Jupyter notebooks that could allow an attacker to perform arbitrary HTTP POST requests on a user's behalf (GitLab Security Release).

The vulnerability stems from improper sanitization of HTML attributes in Jupyter notebooks. While DOMPurify strips Rails Ujs data attributes such as data-url and data-method, it does not strip arbitrary data attributes. This allows attackers to exploit various selector/data-attribute combinations that can be used even with purified HTML. The vulnerability has a CVSS score of 7.7 (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) (GitLab Security Release).

The vulnerability allows attackers to perform arbitrary POST requests as the victim user when they visit a malicious Jupyter notebook. In the worst-case scenario, an attacker could force an admin to create a new admin account, send invites to private projects, or perform other unauthorized actions on behalf of the victim (GitLab Issue).

The vulnerability has been patched in GitLab versions 14.7.1, 14.6.4, and 14.5.4. Users are strongly recommended to upgrade to these or later versions immediately. GitLab.com has already been updated with the patched version (GitLab Security Release).