CVE-2023-1648
Summary
by MITRE • 03/28/2023
An issue has been discovered in GitLab DAST API scanner affecting all versions starting from 1.6.50 before 2.11.0, where Authorization headers was leaked in vulnerability report evidence.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/24/2026
The vulnerability identified in GitLab DAST API scanner represents a critical information disclosure flaw that emerged in versions ranging from 1.6.50 through 2.10.0, specifically affecting the security testing capabilities of the platform. This issue stems from improper handling of authentication credentials within the scanner's output reporting mechanism, where sensitive authorization headers containing potentially confidential access tokens and credentials were inadvertently included in vulnerability reports generated during automated security assessments. The flaw violates fundamental security principles by exposing authentication artifacts that should remain protected from unauthorized access or disclosure throughout the scanning process.
This technical vulnerability corresponds to CWE-209, Information Exposure Through an Error Message, and more specifically aligns with CWE-532, Insertion of Sensitive Information into Log File, as the authorization headers containing sensitive information are being written to evidence files without proper sanitization or filtering mechanisms. The flaw operates at the application level within the DAST scanner component where input validation and output sanitization processes fail to properly handle authentication metadata that is typically stripped from standard API responses during normal operations. When the scanner encounters protected endpoints during testing, it captures the full HTTP request including authorization headers as part of its evidence collection process.
The operational impact of this vulnerability extends beyond simple credential exposure, creating potential attack vectors for adversaries who might gain access to the DAST reports through various means such as compromised build servers, unauthorized personnel accessing test environments, or insecure storage of scan results. The leaked authorization headers could contain bearer tokens, api keys, or other authentication mechanisms that would allow attackers to impersonate legitimate users and potentially escalate privileges within the targeted systems. This exposure is particularly concerning in enterprise environments where DAST scanning is often integrated into continuous integration pipelines and automated security testing workflows, creating persistent access points for malicious actors who might exploit these credentials against production systems.
Security professionals should note this vulnerability's alignment with ATT&CK technique T1580, "Taint Data for Other Attack Vectors, which involves compromising data integrity to enable further attacks. The exposure of authorization headers creates opportunities for lateral movement and privilege escalation within network environments where the compromised tokens might grant access to additional resources beyond the initial scanned targets. Organizations utilizing GitLab DAST should immediately implement mitigations including version upgrades to 2.11.0 or later, which contain patched sanitization routines for authorization header handling. Additional defensive measures should include regular audit of scan report contents, implementation of automated log scanning for sensitive data patterns, and restriction of access to test environments containing potentially exposed credentials. The vulnerability demonstrates the critical importance of proper input/output sanitization in security tools and serves as a reminder that even security testing utilities must be hardened against information disclosure vulnerabilities that could undermine their own protective capabilities.