Skip to content

Latest commit

 

History

History
170 lines (166 loc) · 21.7 KB

TOPGITLAB.md

File metadata and controls

170 lines (166 loc) · 21.7 KB
Raw

Back

Top reports from GitLab program at HackerOne:

  1. Arbitrary file read via the UploadsRewriter when moving and issue to GitLab - 1393 upvotes, $20000
  2. Git flag injection - local file overwrite to remote code execution to GitLab - 743 upvotes, $12000
  3. Exfiltrate and mutate repository and project data through injected templated service to GitLab - 727 upvotes, $11000
  4. Stored XSS in Wiki pages to GitLab - 590 upvotes, $4500
  5. Local files could be overwritten in GitLab, leading to remote command execution to GitLab - 531 upvotes, $12000
  6. Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests to GitLab - 431 upvotes, $12000
  7. gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in allowed_paths to be read to GitLab - 387 upvotes, $10000
  8. Bypass of GitLab CI runner slash fix in YAML validation to GitLab - 348 upvotes, $12000
  9. JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions to GitLab - 347 upvotes, $12000
  10. Attacker is able to access commit title and team member comments which are supposed to be private to GitLab - 335 upvotes, $7000
  11. SSRF on project import via the remote_attachment_url on a Note to GitLab - 332 upvotes, $10000
  12. Server Side Request Forgery mitigation bypass to GitLab - 329 upvotes, $3500
  13. An attacker can run pipeline jobs as arbitrary user to GitLab - 297 upvotes, $12000
  14. Full access to internal Gitlab instances at redash.gitlab.com, dashboards.gitlab.com, prometheus.gitlab.com to GitLab - 291 upvotes, $9500
  15. Cross-site Scripting (XSS) - Stored in RDoc wiki pages to GitLab - 270 upvotes, $3500
  16. Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domain to GitLab - 228 upvotes, $3000
  17. Privilege escalation from any user (including external) to gitlab admin when admin impersonates you to GitLab - 219 upvotes, $10000
  18. Unauthenticated blind SSRF in OAuth Jira authorization controller to GitLab - 215 upvotes, $4000
  19. Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd parties to GitLab - 206 upvotes, $3000
  20. Group search leaks private MRs, code, commits to GitLab - 205 upvotes, $7000
  21. Full Read SSRF on Gitlab's Internal Grafana to GitLab - 193 upvotes, $12000
  22. Ability To Delete User(s) Account Without User Interaction to GitLab - 187 upvotes, $3000
  23. Git flag injection leading to file overwrite and potential remote code execution to GitLab - 165 upvotes, $3500
  24. Snippet JS template allows attacker to read a user's private snippets to GitLab - 163 upvotes, $300
  25. information disclosure of secret_key_base via encoding charcters to GitLab - 143 upvotes, $3500
  26. DoS on the Issue page by exploiting Mermaid. to GitLab - 137 upvotes, $3000
  27. Importing GitLab project archives can replace uploads of other users to GitLab - 136 upvotes, $5000
  28. Persistent XSS in Note objects to GitLab - 132 upvotes, $4500
  29. Send arbitrary PUT requests when user clicks on a link to GitLab - 127 upvotes, $3000
  30. Git flag injection - Search API with scope 'blobs' to GitLab - 121 upvotes, $7000
  31. Read files on application server, leads to RCE to GitLab - 110 upvotes, $0
  32. Group search with Elastic search enable leaks unrelated data to GitLab - 95 upvotes, $7000
  33. Stored XSS in "Create Groups" to GitLab - 82 upvotes, $2500
  34. Unrestricted file upload leads to Stored XSS to GitLab - 81 upvotes, $1500
  35. DoS attack via comment on Issue to GitLab - 77 upvotes, $1000
  36. GitLab-Runner on Windows DOCKER_AUTH_CONFIG container host Command Injection to GitLab - 73 upvotes, $6500
  37. SSRF in CI after first run to GitLab - 69 upvotes, $3000
  38. GitLab::UrlBlocker validation bypass leading to full Server Side Request Forgery to GitLab - 61 upvotes, $5000
  39. GraphQL query "namespace" leaks data to GitLab - 58 upvotes, $1000
  40. Know whether private project name exists or not within a group using link comments to GitLab - 56 upvotes, $300
  41. Ability to access all user authentication tokens, leads to RCE to GitLab - 56 upvotes, $0
  42. [Admin Panel] CSRF to resume/pause runner to GitLab - 53 upvotes, $500
  43. All functions that allow users to specify color code are vulnerable to ReDoS to GitLab - 50 upvotes, $1000
  44. Stored XSS on the job page to GitLab - 49 upvotes, $3000
  45. Clientside resource Exhausting by exploiting gitlab math rendering to GitLab - 49 upvotes, $1000
  46. Command injection by overwriting authorized_keys file through GitLab import to GitLab - 48 upvotes, $2000
  47. Access to GitLab's Slack by abusing issue creation from e-mail to GitLab - 47 upvotes, $0
  48. XSS on Issue reference numbers to GitLab - 46 upvotes, $1500
  49. Bypass Email Verification using Salesforce -- Reproducible in gitlab.com to GitLab - 45 upvotes, $1500
  50. EXIF metadata not stripped from JPG group logos to GitLab - 45 upvotes, $500
  51. Stored XSS in markdown when redacting references to GitLab - 43 upvotes, $5000
  52. View the Starred Projects in a Private Profile to GitLab - 43 upvotes, $500
  53. GitLab CI runner can read and poison cache of all other projects to GitLab - 39 upvotes, $2000
  54. Milestones leaked via search API to GitLab - 39 upvotes, $1000
  55. SQL injection in MilestoneFinder order method to GitLab - 38 upvotes, $2000
  56. Store-XSS in error message of build-dependencies to GitLab - 34 upvotes, $3000
  57. Stored XSS in blob viewer to GitLab - 33 upvotes, $2000
  58. Using GitLab to monitor and hijack domains in mass quantity. to GitLab - 33 upvotes, $750
  59. Bypassing push rules via MRs created by Email to GitLab - 30 upvotes, $3000
  60. Evaluating Ruby code by injecting Rescue job on the system_hook_push queue through web hook to GitLab - 30 upvotes, $750
  61. Insecure 2FA/authentication implementation creates a brute force vulnerability to GitLab - 30 upvotes, $0
  62. Injection of http.\<url\>.* git config settings leading to SSRF to GitLab - 29 upvotes, $3000
  63. Remote hacker can download all the files of master branch in public projects where everything is members only. to GitLab - 29 upvotes, $1500
  64. Privilege escalation due to insecure use of logrotate to GitLab - 29 upvotes, $1000
  65. Uncontrolled Resource Consumption in any Markdown field using Mermaid to GitLab - 29 upvotes, $1000
  66. Vulnerability in project import leads to arbitrary command execution to GitLab - 29 upvotes, $0
  67. Stored XSS in group issue list to GitLab - 27 upvotes, $2000
  68. Mailgun misconfiguration leads to email snooping and postmaster@-access on email.mg.gitlab.com to GitLab - 27 upvotes, $0
  69. Access Projects And create projects in gitlab pre production server to GitLab - 26 upvotes, $1000
  70. Able to leak private email of any user given his/her username via graphql to GitLab - 26 upvotes, $750
  71. Persistent XSS via e-mail when creating merge requests to GitLab - 24 upvotes, $750
  72. GitLab's GitHub integration is vulnerable to SSRF vulnerability to GitLab - 23 upvotes, $2000
  73. Unauthorized access to private project security dashboard to GitLab - 23 upvotes, $2000
  74. Last build status and coverage leaked to unauthorized users to GitLab - 22 upvotes, $750
  75. Unauthorized users may be able to view almost all informations related to Private projects. to GitLab - 22 upvotes, $0
  76. Stored XSS on PyPi simple API endpoint to GitLab - 21 upvotes, $3000
  77. Possibilty to purchase Ultimate - 1 Year (EDU or OSS) to GitLab - 21 upvotes, $500
  78. Stealing data from customers.gitlab.com without user interaction to GitLab - 20 upvotes, $3500
  79. all private tokens are leaked to an unauthenticated attacker to GitLab - 20 upvotes, $0
  80. [Markdown] Stored XSS via character encoding parser bypass to GitLab - 20 upvotes, $0
  81. SafeParamsHelper::safe_params is not so safe to GitLab - 19 upvotes, $4000
  82. Claiming package names in GitLab's automatic package referencer. to GitLab - 19 upvotes, $1000
  83. Add and Access to Labels of any Private Projects/Groups of Gitlab(IDOR) to GitLab - 19 upvotes, $1000
  84. CSV injection in gitlab.com via issues export feature. to GitLab - 19 upvotes, $0
  85. CRLF injection & SSRF in git:// protocal lead to arbitrary code execution to GitLab - 18 upvotes, $0
  86. Race condition in GitLab import, giving access to other people their imports due to filename collision to GitLab - 17 upvotes, $0
  87. Stored XSS in merge request pages to GitLab - 17 upvotes, $0
  88. Instant open redirect on Live preview WEB Ide opening to GitLab - 16 upvotes, $1000
  89. Bypassing password authentication of users that have 2FA enabled to GitLab - 16 upvotes, $0
  90. Privilege escalation to access all private groups and repositories to GitLab - 16 upvotes, $0
  91. Stored XSS on Files overview by abusing git submodule URL to GitLab - 16 upvotes, $0
  92. Gitlab is vulnerable to impersonation attacks due to broken links to GitLab - 15 upvotes, $0
  93. SSRF vulnerability in gitlab.com via project import. to GitLab - 15 upvotes, $0
  94. Insufficient Type Check leading to Developer ability to delete Project, Repository, Group, ... to GitLab - 14 upvotes, $5000
  95. Private System Note Disclosure using GraphQL to GitLab - 14 upvotes, $1000
  96. No redirect_uri in the db for web-internal clientKey leads to one-click DoS on gitter.im to GitLab - 14 upvotes, $1000
  97. Stored XSS on Issue details page to GitLab - 14 upvotes, $0
  98. GitHub import allows user to create child group under existing namespace to GitLab - 13 upvotes, $750
  99. [information disclosure] Validate existence of a private project. to GitLab - 13 upvotes, $500
  100. Persistent XSS on public wiki pages to GitLab - 13 upvotes, $0
  101. User with guest access can access private merge requests to GitLab - 13 upvotes, $0
  102. Insufficient Type Check on GraphQL leading to Maintainer delete repository to GitLab - 12 upvotes, $4000
  103. Transferring a public group to a private group doesn't remove code from the Elastichsearch API search result to GitLab - 12 upvotes, $3000
  104. Removing a user from a private group doesn't remove him from group's project, if his project's role was changed to GitLab - 12 upvotes, $2000
  105. SSRF In plantuml (on plantuml.pre.gitlab.com) to GitLab - 12 upvotes, $100
  106. Every user can delete public deploy keys to GitLab - 12 upvotes, $0
  107. Inadequate cache control in gitter allows to view private chat room to GitLab - 12 upvotes, $0
  108. State filter in IssuableFinder allows attacker to delete all issues and merge requests to GitLab - 11 upvotes, $0
  109. Unfiltered class attribute in markdown code to GitLab - 11 upvotes, $0
  110. SSRF when importing a project from a git repo by URL to GitLab - 11 upvotes, $0
  111. HTML TAG INJECTION ON PROFILE NAME to GitLab - 11 upvotes, $0
  112. GraphQL Query leads to sensitive information disclosure to GitLab - 11 upvotes, $0
  113. Guest users can change the confidentiality attribute on those issues that have been assigned to them to GitLab - 10 upvotes, $100
  114. XSS On meta tags in profile page to GitLab - 10 upvotes, $0
  115. Users can download old project exports due to unclaimed namespace to GitLab - 10 upvotes, $0
  116. Persistent XSS - Selecting users as allowed merge request approvers to GitLab - 10 upvotes, $0
  117. Unauthorized user is able to access schedule pipeline variables and values to GitLab - 9 upvotes, $3000
  118. SSRF into Shared Runner, by replacing dockerd with malicious server in Executor to GitLab - 9 upvotes, $2000
  119. Blocked user Git access through CI/CD token to GitLab - 9 upvotes, $1500
  120. Attacker can extract list of private project's project members to GitLab - 9 upvotes, $0
  121. Boards leak private label names and desciptions to GitLab - 9 upvotes, $0
  122. Users with guest access can post notes to private merge requests, issues, and snippets to GitLab - 9 upvotes, $0
  123. Impersonation attack via Broken Link in Resellers Page to GitLab - 9 upvotes, $0
  124. SSRF vulnerability in gitlab.com webhook to GitLab - 9 upvotes, $0
  125. Head pipeline leaked to unauthorized users via blocking merge request feature to GitLab - 8 upvotes, $1000
  126. Last pipeline status for MR leaked to GitLab - 8 upvotes, $750
  127. Markdown based stored XSS (IE only) to GitLab - 8 upvotes, $0
  128. XSS (Persistent) - Selecting role(s) for protected branches to GitLab - 8 upvotes, $0
  129. Container scanning and Dependency scanning report leaked to unauthorized users to GitLab - 7 upvotes, $3000
  130. Revoked User can still view the Merge Request created by him via API to GitLab - 7 upvotes, $1500
  131. Elasticsearch leaks data through the notes scope to GitLab - 7 upvotes, $1000
  132. [RDoc] XSS in project README files to GitLab - 7 upvotes, $0
  133. [reStructuredText] XSS in project README files to GitLab - 7 upvotes, $0
  134. Gitlab.com is vulnerable to reverse tabnabbing. to GitLab - 7 upvotes, $0
  135. [Subgroups] Unprivileged User Can Disclose Private Group Names to GitLab - 7 upvotes, $0
  136. Gitlab.com is vulnerable to reverse tabnabbing. (#2) to GitLab - 7 upvotes, $0
  137. Persistent XSS - Deleting a project (No Longer Vulnerable in 10.7) to GitLab - 7 upvotes, $0
  138. Todos are not redacted when membership changes - Access to (confidential) issues and merge requests to GitLab - 6 upvotes, $2000
  139. Labels created in private projects are leaked to GitLab - 6 upvotes, $0
  140. Persistent XSS on public project page to GitLab - 6 upvotes, $0
  141. CSRF Token Bypass in Account Deletion to GitLab - 6 upvotes, $0
  142. GFM renderer leaks external issue tracker URL of private project to GitLab - 6 upvotes, $0
  143. Potensial SSRF via Git repository URL to GitLab - 6 upvotes, $0
  144. Double linking cause XSS (but blokeced by CSP in gitlab.com) to GitLab - 6 upvotes, $0
  145. Adding everyone to the repo due to the lack of rate limit to GitLab - 6 upvotes, $0
  146. Attacker can post notes on private MR, snippets, and issues to GitLab - 5 upvotes, $0
  147. Attacker can delete (and read) private project webhooks to GitLab - 5 upvotes, $0
  148. [Textile] XSS in project README files to GitLab - 5 upvotes, $0
  149. Gitlab.com is vulnerable to reverse tabnabbing via AsciiDoc links. (#3) to GitLab - 5 upvotes, $0
  150. Cookie bomb to GitLab - 5 upvotes, $0
  151. Guests Will Disclose the Private Project Full Activity Via Project Activity Feeds to GitLab - 5 upvotes, $0
  152. Private snippets in public / internal projects leaked though GitLab API to GitLab - 4 upvotes, $0
  153. Confidential issues leaked in public projects when attached to milestone to GitLab - 4 upvotes, $0
  154. [Repository Import] Open Redirect via "continue[to]" parameter to GitLab - 4 upvotes, $0
  155. Members from parent group keep their access level on a subgroup transfer and are invisible to GitLab - 3 upvotes, $4000
  156. Initial mirror user can be assigned by other user even if the mirror was removed to GitLab - 3 upvotes, $3000
  157. Project Milestones Disclosed Via Groups When the Victim disabled milestones access in project settings to GitLab - 3 upvotes, $1000
  158. Open redirect to GitLab - 3 upvotes, $0
  159. CSRF-Token leak by request forgery to GitLab - 3 upvotes, $0
  160. SSRF via git Repo by URL Abuse to GitLab - 2 upvotes, $0
  161. Lack of validation before assigning custom domain names leading to abuse of GitLab pages service to GitLab - 2 upvotes, $0
  162. Email notification about login email changed is not received when using verified linked email address to GitLab - 2 upvotes, $0
  163. Missing/Breach of Internal Security Boundary - Access to Job Queue Results in Remote Code Execution to GitLab - 0 upvotes, $0

Back