# Server Side Request Forgery mitigation bypass

GitLab webhook URL blocker skipped DNS-rebinding protection when resolution failed, letting a rebinding DNS server reach internal metadata endpoints via SSRF.

- Payout: hidden
- Severity: high
- Program: GitLab
- Found by: mclaren650sspider
- Disclosed: 2020-04-18
- CVE: CVE-2019-5464
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/632101
- Library page: https://bugbountylibrary.com/r/h1%3A632101
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high tech:gcp technique:incomplete-fix technique:source-review vuln:misconfiguration vuln:ssrf

**Target:** Webhook URL validation / UrlBlocker (gitlab.com)
**Root cause:** UrlBlocker#validate only pins the resolved IP when DNS resolution succeeds; on resolution error it returns without applying the rebinding protection, so a later-resolving domain reaches internal IPs.
**Steps:**
1. Create a repo webhook with URL `http://990.hacker1.xyz` (initially non-resolving); ignore the error.
2. Wait ~10s, then trigger the webhook via Test > Push events.
3. The domain now resolves (via CNAME chain) to an internal IP; the request is sent and `http://169.254.169.254` content is returned.
4. Space attempts ~15s apart to avoid DNS caching; PoC DNS server uses a CNAME chain to defeat caching.
**How found:** Code review of url_blocker.rb line 59: noticed the validate function returns early on DNS resolution error, skipping the rebinding-protection IP pinning.
**Exploitation:** Attacker controls a DNS server whose domain fails to resolve at validation time, bypassing IP pinning; after the webhook is saved, the domain resolves to internal addresses (169.254.169.254, 127.0.0.1) and GitLab fetches them, returning responses to the attacker.
**Escalation:** SSRF to GCP metadata can be chained to RCE depending on cloud setup (references public $25k report #341876).
**Insight:** When a validator pins a resolved IP to defeat rebinding, check the error/exception path: a resolution failure that returns early leaves the hostname unpinned, so a domain that fails first and resolves later slips through.