Case Study for Improper Authentication in GitLab (CVE-2022-22213)

[MaheshPavan666]

We describe a vulnerability in GitLab's OAuth login flow (CVE-2021-22213) that caused GitLab to expose OAuth access tokens in the URL fragment when redirecting its users. Due to security policy violations in Safari, the token was also exposed in the URLs of sites controlled by attackers, making it easy for attackers to steal the token and impersonate users. GitLab resolved the bug by not putting the token in the URL visible in the browser and not sending the token except in server-side requests. GitLab uses the incident as a case study to teach CWE-287 (Improper Authentication) and stresses not putting OAuth tokens in URLs visible in the browser, using secure OAuth flows (e.g., Authorization Code with PKCE), testing browser behavior, using Content Security Policies, and automated leak detection.

[continue]

Keep this PR in a mergeable state →

Learn more

---

All Green is an AI agent that automatically:

✅ Addresses code review comments

✅ Fixes failing CI checks

✅ Resolves merge conflicts

[stevechristeycoley]

Automated Analysis Results of This Use Case

Thank you for providing your use case! Apologies for the form letter, but it's a pleasure to see y'all :)

With technical knowledge work such as this project, it is important to structure information as well as possible, so that it can be processed automatically.

We also want to validate our inputs ;-)

So, this report contains the results of an automated analysis of the provided use case, looking for consistency with the documented format as covered in Section 3 "Case Study Structure" of the Style Guide.

Disclaimers:

• David Wheeler may provide guidance on how to handle these reports. We're grateful that you've put in this work already, and we don't want to burden you unnecessarily 'cuz you're probably busy :)
• Our style guide was not always 100% clear (as often happens early in technical knowledge work), so this analysis attempts to automatically resolve potential inconsistencies.
• This report is provided as a convenience. There may be some errors or omissions in this report.
• We will conduct deeper analysis at a later time.

Items are prioritized from Informative, Low, Medium, to High in terms of current importance to the project.

Analyzing Presence of Markdown

Markdown detected in the document.

Parser Issues

The following issues were encountered by the parser used to analyze this file. This might explain potential errors and false positives in the subsequent analysis.

• [Info] Inferring that line 1 contains the title

Section Analysis

• [Med] Unexpected/non-standard section name: 'Generic example' (this may break analysis)
• [Info] 0 major section-name issues detected.
• [Med] Section 'Introduction' is expected to have 3 hash marks, but it has 2
• [Med] Section 'Software' is expected to have 3 hash marks, but it has 2
• [Med] Section 'Weakness' is expected to have 3 hash marks, but it has 2
• [Med] Section 'Vulnerability' is expected to have 3 hash marks, but it has 2
• [Med] Section 'Exploit' is expected to have 3 hash marks, but it has 2
• [Med] Section 'Fix' is expected to have 3 hash marks, but it has 2
• [Med] Section 'Prevention' is expected to have 3 hash marks, but it has 2
• [Med] Section 'Conclusion' is expected to have 3 hash marks, but it has 2
• [Med] Section 'References' is expected to have 3 hash marks, but it has 2
• [Med] Section 'Contributions' is expected to have 3 hash marks, but it has 2

Analyzing Title Section

Note: the analysis may be incorrect depending on how
you provided the title. This an issue with the analyzer.

Inferred/Extracted Title begins with text: 'Improper Authentication In GitLab'

• [Low] Title does not contain only capital letters

Analyzing Introduction Section

No issues found.

Analyzing Software Section

No issues found.

Analyzing Weakness Section

No issues found.

Analyzing Vulnerability Section

No issues found.

Analyzing Fix Section

No issues found.

Analyzing References Section

No issues found.

[stevechristeycoley]

This is a brief checklist for review of this writeup for possible
inclusion in the Secure Coding Case Studies work.

Review Information

Metadata	Info
Author	Mahesh Pavan Varma Kalidindi
Reviewer	Steve Christey Coley
Start Date	2025-12-19 17:33:00
End Date	2025-12-19 18:08:00
PR	#35
PR Access Date	2025-12-14 19:01:00
Issue	#18
File(s)	improper-authentication-in-gitlab.md
Recommendation	Recommended for MSCCS. Consider for CWE.

Review Summary

Writeup needs to fix some simple syntax errors, capitalization, etc.

Writeup links to CWE-287, but lower-level CWEs are available (CWE-1390
or descendants), and root cause may be a different CWE, (leaking
tokens in error messages), and/or Interaction Error due to unexpected
behavior by Safari. Specific CWE mappings were not investigated
closely.

The code is written in Ruby, which might not be a primary focus for
MSCCS.

Weakness, Vulnerability, Fix, and Weakness sections seem well written. [edit: did I say "Weakness" twice? yes, I did. Mistake on my part, I assume.]

Fix section should probably have a little more code to show how
sanitized_redirect_uri is created, although the amount of code might
be significant.

Reference section: "GitLab Security Advisory" reference appears to be
404. No link to the specific commit is provided.

Recommendation: Recommended for MSCCS, if the Ruby language is in
scope. Consider for CWE as an Observed Example and/or Demonstrative
Example.

Case Study Structure

• writeup follows "Case Study Structure" recommendations without significant errors

Case Study Selection

• CVE
  • CVE ID clearly identified
  • CVE ID follows correct ID syntax
  • CVE is sufficiently recent
  • issue has been fixed
• Detailed reference(s)
  • vulnerable source code available
  • fixed source code available
  • code is properly licensed to be made public
  • (preferred) articles about exploitation

Case Study Contents

Title

• not too vague
• not too technical
• typically follows: <Weakness/Exploit Type> In <Software Name>
• generally between 4 and 6 words
• all caps

Introduction

• typically one paragraph
• issue and consequences in first sentence or two
• weakness type, possibly including position in Top 25
• sentence introducing the software application
• scope of the case study

Software

• has Name
  • include vendor name if applicable
  • avoid version numbers (in this field)
• has Language
• has URL (typically on GitHub if open source)

Weakness

• cites appropriate CWE ID and name
• one to two paragraphs long
• does not discuss the actual vulnerable code
• does not refer to the real software

Vulnerability

• CVE ID listed at the beginning
• discuss what the affected software is used for
• Code walk-through
  • calls out specific lines with language like "On line 123 ..."
  • each line of code contains line numbers
  • calls out specific variables/inputs
  • includes "vulnerable file:" label and filename
  • follows "fenced code block" formatting
  • only cites source code that is necessary to the weakness
  • uses "..." to skip multiple lines of irrelevant source code
  • avoids exploit details

Exploit

• explain how the vulnerability is/was exploited and the consequences
• lists relevant CAPEC ID (if available)
• typically one to three paragraphs in length; could be longer with complex exploits
• when available, shows how certain inputs drive the exploit and how it works through the code

Fix

• describes how the weakness was fixed
• calls out specific lines with language like "On line 123 ..."
• each line of code contains line numbers
• focuses only on the changes related to the weakness
• code follows "fenced code block" formatting
• includes "fixed file:" label and filename
• uses ```diff construct to highlight the diff
• uses "..." to skip multiple lines of irrelevant source code

Prevention

• provides enough detail for the reader to implement the suggestions
• includes relevant secure coding practices
• includes mechanisms of identification e.g. tools
• typically a few paragraphs long

Conclusion

• brief summary of the case study (1 to 2 paragraphs long)
• avoids any new information

References

• name/URL of software page
• name/URL of the CVE
• name/URL of the CWE(s)
• name/URL of the CAPEC(s)
• name/URL of vendor's vuln report
• (if possible) name/URL of the specific code commit with the fix
• name/URL of any article that helped inform the case study
• no unusual/unexpected claims, or backed up by references
• (if available) name/URL for any foundational tutorial or best practice guide
• no reference is 404 or otherwise inaccessible
• avoids listing all possible references

Contributors

• credits significant contributors
• includes original creator and reviewer(s)

Images/Diagrams (Optional)

• helps the reader understand a complex topic
• typically 0 to 2 images; no fixed rule