GitLab Resolve Vulnerability feature vulnerable to prompt injection
GitLab's Resolve Vulnerability feature uses an LLM to generate security patches but fails to sanitize user-controlled fields from SAST reports before inserting them into the LLM prompt. Attackers can inject prompt instructions via crafted SAST reports to make the LLM generate malicious code patches that expose sensitive pipeline secrets.
What happened
GitLab's 'Resolve Vulnerability' feature uses an LLM to generate code patches from SAST vulnerability reports. The feature formats SAST report fields including filename, vulnerable_code, title, and identifiers into an LLM prompt without sanitizing user-controlled input.
An attacker can craft a malicious SAST report containing prompt injection instructions in fields like vulnerability identifiers. When a victim uses the Resolve Vulnerability feature on the attacker's crafted report, the injected instructions are executed by the LLM, which then generates a code patch containing the attacker's desired content.
Reported impact
The injected instructions execute in the context of the victim's pipeline, potentially allowing attackers to expose sensitive values such as CI job tokens that are logged to the job output.
Index analysis
The vulnerability stems from improper neutralization of special elements in the LLM prompt. SAST report fields that are attacker-controllable are inserted directly into the prompt template without escaping or validation, allowing prompt injection attacks.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.