Open redirect
Medium
G
GitLab
Submitted None
Actions:
Reported by
eadz
Vulnerability Details
Technical details and impact analysis
POC:
$GITLAB_INSTANCE = gitlab.com
Visit:
https://$GITLAB_INSTANCE/dashboard/todos?page=99999999&host=www.google.com
Bug is in Dashboard::TodosController line 10
Likey
Same bug in Projects::IssuesController line 32
and other places in the codebase where you `redirect_to params.merge(..)`
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Open Redirect