GitLab CVE-2025-14870: Unauthenticated DoS Risk in CE/EE

title: GitLab CVE-2025-14870 Unauthenticated DoS via Crafted JSON Payload
id: scw-2026-05-14-ai-1
status: experimental
level: high
description: |
  This rule detects potential exploitation of GitLab CVE-2025-14870. It looks for POST requests to GitLab API endpoints, specifically '/api/v4/projects', that result in a 500 Internal Server Error. This specific combination, especially when coupled with unusually large or malformed JSON payloads (which are not directly detectable without payload inspection capabilities), is indicative of an attempt to trigger the Denial of Service vulnerability due to insufficient input validation.
author: SCW Feed Engine (AI-generated)
date: 2026-05-14
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2025-14870/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/api/v4/projects'
      cs-method:
          - 'POST'
      sc-status:
          - '500'
      # The exact JSON payload structure is unknown, but it's likely to be malformed or excessively large.
      # This is a placeholder for a specific JSON structure if known. Without it, we rely on URI, method, and error code.
  selection_base:
      cs-uri|contains:
          - '/api/v4/projects'
  selection_indicators:
      cs-method:
          - 'POST'
      sc-status:
          - '500'
  condition: selection_base AND selection_indicators
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse