Loading HuntDB...

Guest Users can create issues for Sentry errors and track their status

Low
G
GitLab
Submitted None
Reported by maruthi12

Vulnerability Details

Technical details and impact analysis

Improper Access Control - Generic
### Summary According to the [permission docs](https://docs.gitlab.com/ee/user/permissions.html) and [Error Tracking Docs](https://docs.gitlab.com/ee/operations/error_tracking.html#error-tracking-list) , only User with role `Reporter` or more can see or modify the Error Tracking details. However, the "Create Issue" allows a particular `Guest` user to create a reference issue for the error and track its status whenever some other user resolves it. ### Steps to reproduce (Step-by-step guide to reproduce the issue, including:) 1. Consider a private project with `Guest` role user. 2. Connect `Sentry` to this project from the `Maintainer` account. 3. And create new issues in Sentry. This automatically populates these errors in https://gitlab.com/project_name/-/error_tracking/. 4. Now, consider the request for creating an issue. POST Data format for this is as follows: ``` issue[title]=Title issue[description]= Description issue[sentry_issue_attributes][sentry_issue_identifier]=Error_Id authenticity_token= your_auth_token ``` 5. Change `Error_Id` parameter to some Error's reference id value (this is basically Sentry's Error id). 6. Now, execute the request from `Guest`'s session. This creates an issue for that particular error. 7. Now, go to the `Maintainer`'s login and resolve the error. This will close the issue that created by the `Guest User` with the message `@Maintainer resolved the corresponding error and closed the issue`. ## Impact Using this vulnerability, Guest Users can create issues for Sentry errors and track their Status.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$610.00

Submitted

Weakness

Improper Access Control - Generic