Announcing the ControlPlane GitLab Drive-By CORS Exposure Scanner

We are releasing a new open source security tool: the GitLab drive-by CORS exposure scanner. Built as a single, self-contained web page, it is designed to help security teams identify and assess a common blind spot in internal infrastructure deployments.

The Network Isolation Gap

Many organisations run GitLab as an internal alternative to GitHub. A common assumption is that placing the instance behind a VPN or an IP allowlist keeps it entirely safe from external threats. However, by default, GitLab responds to cross-origin requests for its /api/* routes with Access-Control-Allow-Origin: *.

This creates a viable attack path. If a user inside the corporate network or on an allowlisted IP visits a malicious public website, that hostile page can reach the internal GitLab instance through the victim’s browser. The victim’s browser acts as a bridge, allowing an external attacker to interact with the internal service without requiring a GitLab login.

What the Tool Does

To make this exposure concrete, we built a scanner that safely demonstrates the risk. When an authorised user opens the scanner page and inputs a target GitLab address, the tool runs a series of harmless, cross-origin probes.

By safely fingerprinting the target instance, the tool detects the exact GitLab version running. Once the version is identified, it references its bundled catalogue to provide a prioritised list of CVEs that affect that deployment.

Importantly, rather than just listing CVEs affecting that version, the tool confirms whether the instance is actually reachable in this way. By validating this open CORS configuration, it specifically highlights which of those underlying vulnerabilities could be triggered via a CSRF-style attack, in which a malicious web page uses the victim's browser to silently send anonymous requests to the internal instance.

Privacy and Defensive Design

The GitLab drive-by CORS exposure scanner has been built strictly for defensive assessment with the following in place to ensure it behaves safely:

• No phone-home: The published artefact is a single file with all assets and CVE catalogues inlined. It never contacts a third party at runtime.
• Harmless fingerprinting: It uses readable cross-origin channels and asset presence to determine the version; it does not weaponise or exploit the vulnerabilities it finds.
• Clear scope: It explicitly marks findings as "Vulnerable" or "Indeterminate" based on whether client-side fingerprinting can definitively rule out a specific patch release.

Try It Out

This tool turns a theoretical network configuration risk into an evidence-backed list of actionable findings. We encourage infrastructure and security teams to use it to assess the instances they are authorised to test.

• Try the scanner directly in your browser: https://controlplaneio.github.io/gitlab-scanner/ (opens in a new tab)
• Review the code, read the full methodology, or contribute on GitHub: https://github.com/controlplaneio/gitlab-scanner (opens in a new tab)

Disclaimer: This tool is a prioritisation aid, not a definitive verdict. Always confirm individual findings with your own configuration, edition, and authentication reviews.