Server Side Request Forgery mitigation bypass

### Summary This vulnerability allows attacker to send arbitrary requests to local network which hosts GitLab and read the response. This is possible due to flawed DNS rebinding protection. The attack is possible due to flaw here: https://gitlab.com/gitlab-org/gitlab-ce/blob/108c3cf16bed5733ffae086fb62c226961356560/lib/gitlab/url_blocker.rb#L59 The `validate` function performs DNS lookup to check whether the IP address of a domain belongs to the local network. If the IP address belongs to the local network, the `validate` function raises an error and no HTTP request is sent. Furthermore, `validate` returns URI as well as the IP address of the domain to protect against DNS rebinding attacks. However, if `validate` encounters an error while resolving the domain (for example, the domain does not resolve), the DNS rebinding protection is not applied. ### Steps to reproduce 1. Create a webhook for a repository on GitLab.com. Use the URL `http://990.hacker1.xyz`. It may return error but let's ignore it now. 2. Wait about 10 seconds and test webhook by clicking on "Test" and "Push events". 3. After the hook has executed, you should see content of `http://169.254.169.254` returned. Wait about 15 seconds between testing attempts, otherwise it may not work due to DNS caching. The code for proof-of-concept DNS server which hosts `hacker1.xyz` is attached. The PoC uses a chain of CNAME records to prevent caching. ### What is the current *bug* behavior? The outgoing HTTP requests from webhooks can be sent to the internal network. ### What is the expected *correct* behavior? It is expected that HTTP requests cannot be sent to the internal network. ### Relevant logs and/or screenshots F519096 Content of `http://169.254.169.254` F519095 Content of `http://127.0.0.1` ### Output of checks This bug happens on GitLab.com ## Impact Attacker can use SSRF to access sensitive information on the internal network. Furthermore, SSRF in Google Cloud can be leveraged to Remote Code Execution depending on the setup. Publicly disclosed $25,000 #341876 describes a way to gain root access to Google Cloud server via a SSRF vulnerability.