Loading HuntDB...

Access Projects And create projects in gitlab pre production server

Low
G
GitLab
Submitted None
Reported by uzsunnyz

Vulnerability Details

Technical details and impact analysis

Improper Access Control - Generic
### Steps to reproduce Go to https://pre.gitlab.com Here any one can register and can view the pre production projects of gitlab developers. I have registered in https://pre.gitlab.com/users/sign_in and have created one test group and test project go to https://pre.gitlab.com/explore/groups i have created one test group {F470509} And i have created one test project {F470510} I went to look for gitlab project members https://pre.gitlab.com/qa-perf-testing/gitlabhq/project_members I have seen it was created by your gitlab employee Ramya Authappan https://pre.gitlab.com/rauthappan The attacker not only access the internal projects of gitlab but he can also create groups and projects in pre production server of gitlab. ## Impact Attacker will access the pre production server of gitlab and he access the groups and projects created by gitlab employees. Attacker will also create the projects and groups in pre production server of gitlab.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Improper Access Control - Generic