CVE-2022-3573: 
GitLab vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in GitLab CE/EE affecting versions 15.4 through 15.7.2. The vulnerability, identified as CVE-2022-3573, was discovered in October 2022 and patched in January 2023. The issue affects self-hosted GitLab instances running without strict Content Security Policy (CSP) (GitLab Release, CVE Mitre).

The vulnerability stems from improper filtering of query parameters in the wiki changes page. The issue occurs in the app/views/projects/diffs/_diffs.html.haml file where request.query_parameters is used instead of safe_params to pass parameters to link_to. This implementation allows arbitrary parameters to be passed, including protocol or host parameters, enabling potential javascript: URL injections. The vulnerability has been assigned a CVSS score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicating medium severity (GitLab Release).

When exploited, this vulnerability allows attackers to execute arbitrary JavaScript code in the victim's browser context on self-hosted instances running without strict CSP. This could potentially lead to performing actions on behalf of the affected user and compromise their account security (GitLab Issue).

The vulnerability requires an attacker to have low privileges (ability to create a project) and user interaction. The attack can be performed over the internet, with relatively low complexity. The exploit involves crafting specific URLs with malicious parameters that can bypass the existing security controls on instances without strict CSP (GitLab Issue).

GitLab has addressed this vulnerability in versions 15.5.7, 15.6.4, and 15.7.2. Organizations running affected versions should upgrade immediately to one of these patched versions. Additionally, implementing strict Content Security Policy (CSP) serves as an effective mitigation measure against this type of attack (GitLab Release).

The vulnerability was responsibly disclosed through GitLab's HackerOne bug bounty program by security researcher ryotak. GitLab acknowledged the issue and addressed it in their security release, demonstrating their commitment to maintaining security standards (GitLab Release).