Guest Users can create issues for Sentry errors and track their status
Low
G
GitLab
Submitted None
Actions:
Reported by
maruthi12
Vulnerability Details
Technical details and impact analysis
### Summary
According to the [permission docs](https://docs.gitlab.com/ee/user/permissions.html) and [Error Tracking Docs](https://docs.gitlab.com/ee/operations/error_tracking.html#error-tracking-list) , only User with role `Reporter` or more can see or modify the Error Tracking details. However, the "Create Issue" allows a particular `Guest` user to create a reference issue for the error and track its status whenever some other user resolves it.
### Steps to reproduce
(Step-by-step guide to reproduce the issue, including:)
1. Consider a private project with `Guest` role user.
2. Connect `Sentry` to this project from the `Maintainer` account.
3. And create new issues in Sentry. This automatically populates these errors in https://gitlab.com/project_name/-/error_tracking/.
4. Now, consider the request for creating an issue.
POST Data format for this is as follows:
```
issue[title]=Title
issue[description]= Description
issue[sentry_issue_attributes][sentry_issue_identifier]=Error_Id
authenticity_token= your_auth_token
```
5. Change `Error_Id` parameter to some Error's reference id value (this is basically Sentry's Error id).
6. Now, execute the request from `Guest`'s session. This creates an issue for that particular error.
7. Now, go to the `Maintainer`'s login and resolve the error. This will close the issue that created by the `Guest User` with the message `@Maintainer resolved the corresponding error and closed the issue`.
## Impact
Using this vulnerability, Guest Users can create issues for Sentry errors and track their Status.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$610.00
Submitted
Weakness
Improper Access Control - Generic