Adding everyone to the repo due to the lack of rate limit
High
G
GitLab
Submitted None
Actions:
Reported by
sadd_man
Vulnerability Details
Technical details and impact analysis
### Summary
Since there is no rate limit in the inviting users to the repository section, it is possible to add all users on gitlab to a repository.
### Steps to reproduce
(Step-by-step guide to reproduce the issue, including:)
1. Create a repository
2. go to the project members section
3. choose a random user
4. before clicking the invite button, we need to capture the request with the burp suite..
5. ███████
6. Send it to the Intruder module, specify the █████ field here between 1 and 7006996 and send the request.
### Impact
It is possible to collect all users on Gitlab in a single repository, so users' mailboxes will be filled with notifications.
### Note
Because the rate limit is out of scope, I tested it and I could not stop the python script, and there were users affected.
## Impact
It is possible to collect all users on Gitlab in a single repository, so users' mailboxes will be filled with notifications.
Report Details
Additional information and metadata
State
Closed
Substate
Not-Applicable
Submitted
Weakness
Insecure Direct Object Reference (IDOR)