View the Starred Projects in a Private Profile
HackerOne report #703894 by maruthi12 on 2019-09-29, assigned to @cmaxim:
Summary
It is possible to view the starred Projects in a private profile. Consider my profile for instance, https://gitlab.com/maruthi-adithya . This is a private profile and none of my account-related information should be leaked. However, https://gitlab.com/users/maruthi-adithya/starred.json exposes Starred Projects.
Steps to reproduce
- Login to Gitlab. Go to Settings.
- Check "Don't display activity-related personal information on your profiles".
- Save the Profile.
- Now, open your profile from a private window. It will say this is a private profile. However, the above mentioned API exposes the starred projects information.
Impact
According to the docs, https://gitlab.com/help/user/profile/index.md#private-profile, starred projects should be hidden. However, due to this API, it is getting exposed. Using this, an attacker could steal sensitive data from a private profile.