Loading HuntDB...

Adding everyone to the repo due to the lack of rate limit

High
G
GitLab
Submitted None
Reported by sadd_man

Vulnerability Details

Technical details and impact analysis

Insecure Direct Object Reference (IDOR)
### Summary Since there is no rate limit in the inviting users to the repository section, it is possible to add all users on gitlab to a repository. ### Steps to reproduce (Step-by-step guide to reproduce the issue, including:) 1. Create a repository 2. go to the project members section 3. choose a random user 4. before clicking the invite button, we need to capture the request with the burp suite.. 5. ███████ 6. Send it to the Intruder module, specify the █████ field here between 1 and 7006996 and send the request. ### Impact It is possible to collect all users on Gitlab in a single repository, so users' mailboxes will be filled with notifications. ### Note Because the rate limit is out of scope, I tested it and I could not stop the python script, and there were users affected. ## Impact It is possible to collect all users on Gitlab in a single repository, so users' mailboxes will be filled with notifications.

Report Details

Additional information and metadata

State

Closed

Substate

Not-Applicable

Submitted

Weakness

Insecure Direct Object Reference (IDOR)