CVE-2022-4206

What it actually does

The DAST API scanner includes the full Authorization header value in generated vulnerability reports for all versions from 1.6.50 up to but not including 2.0.102.

Why it matters to the business

Exposed API credentials in reports can lead to unauthorized access to protected services, data exposure, and potential compliance violations if reports are viewed by unintended recipients.

How an attack unfolds

An attacker with read access to DAST vulnerability reports inspects the report contents, extracts the leaked Authorization header containing valid credentials, and reuses those credentials to authenticate to target APIs.

How to fix it

Upgrade GitLab DAST API scanner to version 2.0.102 or later; regenerate reports after upgrade and rotate any credentials that may have appeared in prior reports.

How to confirm the fix worked

Confirm scanner version is 2.0.102 or higher; inspect newly generated reports to verify Authorization headers are absent; review report templates and output sanitization settings.

Typical attack path

1. Obtain access to DAST vulnerability reports
2. Locate Authorization header values within the report output
3. Replay the extracted credentials against protected API endpoints

How to detect it

Search vulnerability report files and archives for Authorization header strings; review access logs to report storage locations for unexpected viewers; check scanner output directories for legacy reports containing credential data.

• Authorization: Bearer
• Authorization: Basic
• report contains "Authorization" header
• dast-api-scanner vulnerability report

What your security team should do

• Immediately upgrade all DAST API scanner instances to 2.0.102 or later
• Audit historical reports for exposed credentials and rotate affected tokens
• Restrict report access to least-privilege roles and enable logging of report views