Private Projects' Jobs/Pipelines/namespace are leaked to Specific Runner Jobs API endpoint
Link: https://hackerone.com/reports/423853
By: @ngalog
Details:
Summary:
Quick intro on specific runner in gitlab. Specific runner is designed for gitlab user who wants to have dedicated runner to run pipelines without using shared runner on gitlab.com And after you register specific runner on a particular project, other maintainer of that project could also enable the runner you registered to other private project that you don't have access to. You can read more here
Note: Consider that if you don't lock your specific Runner to a specific project, any user with Maintainer role in you project can assign your Runner to another arbitrary project without requiring your authorization, so use it with caution.
Description:
I can see gitlab runner accept other maintainer of a specific runner enabled project to re-use that runner to other project. And I also notice there is access control in place for that runner, i.e. when you visit https://gitlab.com/api/v4/runners/:runner_id
, you are only able to see the project you have access. Even other maintainer register this runner to other private project, you won't be able to see the private project details that belongs to other maintainer.
However, there is no access control in https://gitlab.com/api/v4/runners/:runner_id/jobs
, i.e. the private project jobs/pipeline details are shown in the response even you don't have access to that private project
Steps To Reproduce (Slow):
- User A prepare a project with a specific runner, share this with another user B and assign him with maintainer access -- url: https://gitlab.com/:project_namespace/settings/ci_cd
- user B enable this specific runner for his private project, do some random pipeline, in the meanwhile, make note of the id of that runner, the runner id is shown in url when you click the edit button of that specific runner
- Now, as user A, visit https://gitlab.com/api/v4/runners/:runner_id , you should only be able to see the project name that you have access to read, and you can't see the private project that belongs to user B
- However, as user A, you can see the private project namespace, commit messages, job pipeline details etc in https://gitlab.com/api/v4/runners/:runner_id/jobs
Quick way to reproduce
SInce I notice @jritchey and @asaba are usually responsible for the communication in H1 program, I took advantage of adding user without permission, to add you guys as the maintainer to my project.
Now you should login to your gitlab account, then visit https://gitlab.com/api/v4/runners/503441/
You should able to see one project name incomingpublicgroupfortestfffff/privateproject
However when you visit https://gitlab.com/api/v4/runners/503441/jobs YOu will see a lot more private project names and job details that you shouldn't have access.
Impact
sample response leaked
[{"id":105452267,"status":"success","stage":"test","name":"rspec","ref":"notprotected","tag":false,"coverage":null,"created_at":"2018-10-07T05:58:23.128Z","started_at":"2018-10-07T05:59:02.310Z","finished_at":"2018-10-07T05:59:12.890Z","duration":10.579951,"user":{"id":2811996,"name":"gold","username":"golduserngalog","state":"active","avatar_url":"https://secure.gravatar.com/avatar/908713a4d12924fdd0b68b03d92c08d3?s=80\u0026d=identicon","web_url":"https://gitlab.com/golduserngalog","bio":"","location":"","public_email":"","skype":"","linkedin":"","twitter":"","website_url":"","organization":""},"commit":{"id":"f08aa6a2c2acae3eb1bcbfaf7977be0624dcc04f","short_id":"f08aa6a2","title":"Update .gitlab-ci.yml","created_at":"2018-10-07T05:58:22.000Z","parent_ids":["afb0cb8437220d5e31f78f5ed8a7e92fbf2cd48b"],"message":"Update .gitlab-ci.yml","author_name":"gold","author_email":"ngalog@ngailong.com","authored_date":"2018-10-07T05:58:22.000Z","committer_name":"gold","committer_email":"ngalog@ngailong.com","committed_date":"2018-10-07T05:58:22.000Z"},"pipeline":{"id":32209851,"sha":"f08aa6a2c2acae3eb1bcbfaf7977be0624dcc04f","ref":"notprotected","status":"success","web_url":"https://gitlab.com/golduserngalog/dfgsgfdg/pipelines/32209851"},"web_url":"https://gitlab.com/golduserngalog/dfgsgfdg/-/jobs/105452267","project":{"id":8634923,"description":"","name":"dfgsfd","name_with_namespace":"gold / dfgsfd","path":"dfgsgfdg","path_with_namespace":"golduserngalog/dfgsgfdg","created_at":"2018-09-30T22:46:15.378Z"}},{"id":105470034,"status":"success","stage":"test","name":"rspec","ref":"notprotected","tag":false,"coverage":null,"created_at":"2018-10-07T09:50:56.297Z","started_at":"2018-10-07T09:51:03.554Z","finished_at":"2018-10-07T09:51:08.170Z","duration":4.616168,"user":{"id":2134209,"name":"Ron Chan","username":"ngalongc","state":"active","avatar_url":"https://secure.gravatar.com/avatar/edcf3dd2251559ed90071ce35caf85fc?s=80\u0026d=identicon","web_url":"https://gitlab.com/ngalongc","bio":"\"\u003e\"\u003e\"\u003e\"\u003e\"\u003e","location":"","public_email":"","skype":"","linkedin":"","twitter":"twitter.com/nhihi","website_url":"","organization":""},"commit":{"id":"28257df5c69599e23d32aac7a4282f5b6211273e","short_id":"28257df5","title":"Update .gitmodules","created_at":"2018-10-07T09:50:46.000Z","parent_ids":["f08aa6a2c2acae3eb1bcbfaf7977be0624dcc04f"],"message":"Update .gitmodules","author_name":"Ron Chan","author_email":"test@ngailong.com","authored_date":"2018-10-07T09:50:46.000Z","committer_name":"Ron Chan","committer_email":"test@ngailong.com","committed_date":"2018-10-07T09:50:46.000Z"},"pipeline":{"id":32216012,"sha":"28257df5c69599e23d32aac7a4282f5b6211273e","ref":"notprotected","status":"success","web_url":"https://gitlab.com/golduserngalog/dfgsgfdg/pipelines/32216012"},"web_url":"https://gitlab.com/golduserngalog/dfgsgfdg/-/jobs/105470034","project":{"id":8634923,"description":"","name":"dfgsfd","name_with_namespace":"gold / dfgsfd","path":"dfgsgfdg","path_with_namespace":"golduserngalog/dfgsgfdg","created_at":"2018-09-30T22:46:15.378Z"}},{"id":107332671,"status":"success","stage":"test","name":"test","ref":"master","tag":false,"coverage":null,"created_at":"2018-10-12T02:59:27.271Z","started_at":"2018-10-12T03:00:03.540Z","finished_at":"2018-10-12T03:00:08.426Z","duration":4.885702,"user":{"id":2811996,"name":"gold","username":"golduserngalog","state":"active","avatar_url":"https://secure.gravatar.com/avatar/908713a4d12924fdd0b68b03d92c08d3?s=80\u0026d=identicon","web_url":"https://gitlab.com/golduserngalog","bio":"","location":"","public_email":"","skype":"","linkedin":"","twitter":"","website_url":"","organization":""},"commit":{"id":"96e3da161fb4fbc14eff68188109069ef4cad3b2","short_id":"96e3da16","title":"Update .gitlab-ci.yml","created_at":"2018-10-12T02:59:26.000Z","parent_ids":["b1f87726a828b20d893479694f3a2764ff946163"],"message":"Update .gitlab-ci.yml","author_name":"gold","author_email":"ngalog@ngailong.com","authored_date":"2018-10-12T02:59:26.000Z","committer_name":"gold","committer_email":"ngalog@ngailong.com","committed_date":"2018-10-12T02:59:26.000Z"},"pipeline":{"id":32742231,"sha":"96e3da161fb4fbc14eff68188109069ef4cad3b2","ref":"master","status":"success","web_url":"https://gitlab.com/golduserngalog/privateprojectagain/pipelines/32742231"},"web_url":"https://gitlab.com/golduserngalog/privateprojectagain/-/jobs/107332671","project":{"id":8525300,"description":"","name":"privateprojectagain","name_with_namespace":"gold / privateprojectagain","path":"privateprojectagain","path_with_namespace":"golduserngalog/privateprojectagain","created_at":"2018-09-24T03:55:02.152Z"}},{"id":107332672,"status":"success","stage":"build","name":"build","ref":"master","tag":false,"coverage":null,"created_at":"2018-10-12T02:59:27.291Z","started_at":"2018-10-12T03:00:09.530Z","finished_at":"2018-10-12T03:00:14.166Z","duration":4.636303,"user":{"id":2811996,"name":"gold","username":"golduserngalog","state":"active","avatar_url":"https://secure.gravatar.com/avatar/908713a4d12924fdd0b68b03d92c08d3?s=80\u0026d=identicon","web_url":"https://gitlab.com/golduserngalog","bio":"","location":"","public_email":"","skype":"","linkedin":"","twitter":"","website_url":"","organization":""},"commit":{"id":"96e3da161fb4fbc14eff68188109069ef4cad3b2","short_id":"96e3da16","title":"Update .gitlab-ci.yml","created_at":"2018-10-12T02:59:26.000Z","parent_ids":["b1f87726a828b20d893479694f3a2764ff946163"],"message":"Update .gitlab-ci.yml","author_name":"gold","author_email":"ngalog@ngailong.com","authored_date":"2018-10-12T02:59:26.000Z","committer_name":"gold","committer_email":"ngalog@ngailong.com","committed_date":"2018-10-12T02:59:26.000Z"},"pipeline":{"id":32742231,"sha":"96e3da161fb4fbc14eff68188109069ef4cad3b2","ref":"master","status":"success","web_url":"https://gitlab.com/golduserngalog/privateprojectagain/pipelines/32742231"},"web_url":"https://gitlab.com/golduserngalog/privateprojectagain/-/jobs/107332672","project":{"id":8525300,"description":"","name":"privateprojectagain","name_with_namespace":"gold / privateprojectagain","path":"privateprojectagain","path_with_namespace":"golduserngalog/privateprojectagain","created_at":"2018-09-24T03:55:02.152Z"}},{"id":107332673,"status":"success","stage":"deploy","name":"deploy_staging","ref":"master","tag":false,"coverage":null,"created_at":"2018-10-12T02:59:27.308Z","started_at":"2018-10-12T03:00:15.531Z","finished_at":"2018-10-12T03:00:20.102Z","duration":4.570727,"user":{"id":2811996,"name":"gold","username":"golduserngalog","state":"active","avatar_url":"https://secure.gravatar.com/avatar/908713a4d12924fdd0b68b03d92c08d3?s=80\u0026d=identicon","web_url":"https://gitlab.com/golduserngalog","bio":"","location":"","public_email":"","skype":"","linkedin":"","twitter":"","website_url":"","organization":""},"commit":{"id":"96e3da161fb4fbc14eff68188109069ef4cad3b2","short_id":"96e3da16","title":"Update .gitlab-ci.yml","created_at":"2018-10-12T02:59:26.000Z","parent_ids":["b1f87726a828b20d893479694f3a2764ff946163"],"message":"Update .gitlab-ci.yml","author_name":"gold","author_email":"ngalog@ngailong.com","authored_date":"2018-10-12T02:59:26.000Z","committer_name":"gold","committer_email":"ngalog@ngailong.com","committed_date":"2018-10-12T02:59:26.000Z"},"pipeline":{"id":32742231,"sha":"96e3da161fb4fbc14eff68188109069ef4cad3b2","ref":"master","status":"success","web_url":"https://gitlab.com/golduserngalog/privateprojectagain/pipelines/32742231"},"web_url":"https://gitlab.com/golduserngalog/privateprojectagain/-/jobs/107332673","project":{"id":8525300,"description":"","name":"privateprojectagain","name_with_namespace":"gold / privateprojectagain","path":"privateprojectagain","path_with_namespace":"golduserngalog/privateprojectagain","created_at":"2018-09-24T03:55:02.152Z"}},{"id":107333099,"status":"success","stage":"test","name":"test","ref":"master","tag":false,"coverage":null,"created_at":"2018-10-12T03:03:34.996Z","started_at":"2018-10-12T03:03:36.558Z","finished_at":"2018-10-12T03:03:40.995Z","duration":4.437689,"user":{"id":2811996,"name":"gold","username":"golduserngalog","state":"active","avatar_url":"https://secure.gravatar.com/avatar/908713a4d12924fdd0b68b03d92c08d3?s=80\u0026d=identicon","web_url":"https://gitlab.com/golduserngalog","bio":"","location":"","public_email":"","skype":"","linkedin":"","twitter":"","website_url":"","organization":""},"commit":{"id":"f5cac8fc0faa007a0498575b92a058e129ca915c","short_id":"f5cac8fc","title":"Update .gitlab-ci.yml","created_at":"2018-10-12T03:03:34.000Z","parent_ids":["96e3da161fb4fbc14eff68188109069ef4cad3b2"],"message":"Update .gitlab-ci.yml","author_name":"gold","author_email":"ngalog@ngailong.com","authored_date":"2018-10-12T03:03:34.000Z","committer_name":"gold","committer_email":"ngalog@ngailong.com","committed_date":"2018-10-12T03:03:34.000Z"},"pipeline":{"id":32742384,"sha":"f5cac8fc0faa007a0498575b92a058e129ca915c","ref":"master","status":"success","web_url":"https://gitlab.com/golduserngalog/privateprojectagain/pipelines/32742384"},"web_url":"https://gitlab.com/golduserngalog/privateprojectagain/-/jobs/107333099","project":{"id":8525300,"description":"","name":"privateprojectagain","name_with_namespace":"gold / privateprojectagain","path":"privateprojectagain","path_with_namespace":"golduserngalog/privateprojectagain","created_at":"2018-09-24T03:55:02.152Z"}},{"id":107333100,"status":"success","stage":"build","name":"build","ref":"master","tag":false,"coverage":null,"created_at":"2018-10-12T03:03:35.017Z","started_at":"2018-10-12T03:03:42.553Z","finished_at":"2018-10-12T03:03:47.057Z","duration":4.503932,"user":{"id":2811996,"name":"gold","username":"golduserngalog","state":"active","avatar_url":"https://secure.gravatar.com/avatar/908713a4d12924fdd0b68b03d92c08d3?s=80\u0026d=identicon","web_url":"https://gitlab.com/golduserngalog","bio":"","location":"","public_email":"","skype":"","linkedin":"","twitter":"","website_url":"","organization":""},"commit":{"id":"f5cac8fc0faa007a0498575b92a058e129ca915c","short_id":"f5cac8fc","title":"Update .gitlab-ci.yml","created_at":"2018-10-12T03:03:34.000Z","parent_ids":["96e3da161fb4fbc14eff68188109069ef4cad3b2"],"message":"Update .gitlab-ci.yml","author_name":"gold","author_email":"ngalog@ngailong.com","authored_date":"2018-10-12T03:03:34.000Z","committer_name":"gold","committer_email":"ngalog@ngailong.com","committed_date":"2018-10-12T03:03:34.000Z"},"pipeline":{"id":32742384,"sha":"f5cac8fc0faa007a0498575b92a058e129ca915c","ref":"master","status":"success","web_url":"https://gitlab.com/golduserngalog/privateprojectagain/pipelines/32742384"},"web_url":"https://gitlab.com/golduserngalog/privateprojectagain/-/jobs/107333100","project":{"id":8525300,"description":"","name":"privateprojectagain","name_with_namespace":"gold / privateprojectagain","path":"privateprojectagain","path_with_namespace":"golduserngalog/privateprojectagain","created_at":"2018-09-24T03:55:02.152Z"}},{"id":107333101,"status":"success","stage":"deploy","name":"deploy_staging","ref":"master","tag":false,"coverage":null,"created_at":"2018-10-12T03:03:35.038Z","started_at":"2018-10-12T03:03:48.559Z","finished_at":"2018-10-12T03:03:52.966Z","duration":4.407082,"user":{"id":2811996,"name":"gold","username":"golduserngalog","state":"active","avatar_url":"https://secure.gravatar.com/avatar/908713a4d12924fdd0b68b03d92c08d3?s=80\u0026d=identicon","web_url":"https://gitlab.com/golduserngalog","bio":"","location":"","public_email":"","skype":"","linkedin":"","twitter":"","website_url":"","organization":""},"commit":{"id":"f5cac8fc0faa007a0498575b92a058e129ca915c","short_id":"f5cac8fc","title":"Update .gitlab-ci.yml","created_at":"2018-10-12T03:03:34.000Z","parent_ids":["96e3da161fb4fbc14eff68188109069ef4cad3b2"],"message":"Update .gitlab-ci.yml","author_name":"gold","author_email":"ngalog@ngailong.com","authored_date":"2018-10-12T03:03:34.000Z","committer_name":"gold","committer_email":"ngalog@ngailong.com","committed_date":"2018-10-12T03:03:34.000Z"},"pipeline":{"id":32742384,"sha":"f5cac8fc0faa007a0498575b92a058e129ca915c","ref":"master","status":"success","web_url":"https://gitlab.com/golduserngalog/privateprojectagain/pipelines/32742384"},"web_url":"https://gitlab.com/golduserngalog/privateprojectagain/-/jobs/107333101","project":{"id":8525300,"description":"","name":"privateprojectagain","name_with_namespace":"gold / privateprojectagain","path":"privateprojectagain","path_with_namespace":"golduserngalog/privateprojectagain","created_at":"2018-09-24T03:55:02.152Z"}},{"id":107347763,"status":"success","stage":"test","name":"container_scanning","ref":"master","tag":false,"coverage":null,"created_at":"2018-10-12T04:27:29.481Z","started_at":"2018-10-12T04:27:30.977Z","finished_at":"2018-10-12T04:27:37.303Z","duration":6.326622,"user":{"id":2811996,"name":"gold","username":"golduserngalog","state":"active","avatar_url":"https://secure.gravatar.com/avatar/908713a4d12924fdd0b68b03d92c08d3?s=80\u0026d=identicon","web_url":"https://gitlab.com/golduserngalog","bio":"","location":"","public_email":"","skype":"","linkedin":"","twitter":"","website_url":"","organization":""},"commit":{"id":"cbf131795217951bdcebf3c39607ee90274c8446","short_id":"cbf13179","title":"Update .gitlab-ci.yml","created_at":"2018-10-09T09:35:11.000Z","parent_ids":["c48e730f68233702fe64003c3cfab91ad1ab1539"],"message":"Update .gitlab-ci.yml","author_name":"gold","author_email":"ngalog@ngailong.com","authored_date":"2018-10-09T09:35:11.000Z","committer_name":"gold","committer_email":"ngalog@ngailong.com","committed_date":"2018-10-09T09:35:11.000Z"},"pipeline":{"id":32747023,"sha":"cbf131795217951bdcebf3c39607ee90274c8446","ref":"master","status":"success","web_url":"https://gitlab.com/golduserngalog/dfgsgfdg/pipelines/32747023"},"web_url":"https://gitlab.com/golduserngalog/dfgsgfdg/-/jobs/107347763","project":{"id":8634923,"description":"","name":"dfgsfd","name_with_namespace":"gold / dfgsfd","path":"dfgsgfdg","path_with_namespace":"golduserngalog/dfgsgfdg","created_at":"2018-09-30T22:46:15.378Z"}}]