{"id":119998164,"iid":385050,"description":"**[HackerOne report #1791518](https://hackerone.com/reports/1791518)** by `vaib25vicky` on 2022-12-03, assigned to @cmaxim:\n\n[Report](#report) | [Attachments](#attachments) | [How To Reproduce](#how-to-reproduce)\n\n## Report\n\nHi,\n\nIn the past I've submitted same issues(https://hackerone.com/reports/1258092) affecting Gitlab.com but those bugs become ineffective because of new unrelated changes are deployed. Gitlab.com is saved and instances don't allow Group saml sso at that time.  \nHowever, after 1 year,  Gitlab self-hosted instances allow Group saml sso and same bugs resurfaced. Gitlab self-hosted instances are vulnerable now and not Gitlab.com\n\n####  Summary:\n\nGroup with SAML SSO when transferred to new namespace as a child group then group SAML SSO setting options become invisible.  \nBut all the previous config still works such as SSO and SCIM token  \nThis bug can be exploited for three things  \n1. Previous owner transferred the group to private namespace, he got kicked out of the new group but he can again SSO into the group with owner permission.  \nNew owner can't stop him because SSO settings are invisible  \n2. Billing is associated with the parent group so when the group with SAML SSO transfer to the parent group on free plan, SSO still works and allows paid feature group SAML SSO and SCIM to use as free  \n3. Since, group SAML SSO becomes invisible SCIM token can longer be reset so in case when SCIM token is known to previous users or got leaked  \nthen token can be used to create new users in the group with higher permissions\n\n####  Steps-to-reproduce:  \nYou can also try my POC given below where most of the things are already configured and you just have to exploit. This is much simple poc and suggested to use for quick triage!\n\n#####  SCIM Token\n\n1. set-up group sso and creates SCIM token  \n2. transfer the group to a new namespace/group as child group  \n3. child group saml sso setting becomes invisible  \n4. use the token to creates a new user (https://docs.gitlab.com/ee/development/internal_api/index.html#create-a-scim-provisioned-user) in the child group\n\n```curl\ncurl --request POST \"https://gdk.test:3443/api/scim/v2/groups/lakita-group%2Fmadie-group/Users\" \\\n     --data '{\"externalId\":\"test_uid\",\"active\":null,\"userName\":\"username\",\"emails\":[{\"primary\":true,\"type\":\"work\",\"value\":\"name@example.com\"}],\"name\":{\"formatted\":\"Test User\",\"familyName\":\"User\",\"givenName\":\"Test\"},\"schemas\":[\"urn:ietf:params:scim:schemas:core:2.0:User\"],\"meta\":{\"resourceType\":\"User\"}}' \\\n     --header \"Authorization: Bearer \u003cSCIM_TOKEN\u003e\" --header \"Content-Type: application/scim+json\"\n```  \nUser will be successfully created \n\n#####  SSO into new private group  \n1. set up group sso and generate scim token  \n2. transfer the group as a child group in different namespace (private group)  \n3. remove previous owner, they can't access the private group  \n4. change your idP config of the saml and replace old group path to the new one  \n5. go the saml auth url directly and intercept the request  \n6. change the path parameter with the new namespace  \n7. continue the authorization process  \nOn success, previous owner will again gain owner permission in the new private group where he didn't have any access initially\n\n###  POC:\n\nMy Gitlab Instance [REDACTED]\n\nGroup named `test` was a top-level group with saml sso configured. It was later transferred to group named `group-two`. Previous user kicked out and since, `test` group is now a sub-group, new owner can't access saml sso settings in `test` sub-group and can't disable it.\n\nPrevious user log-in to their idP dashboard and initiate login to gain access to new private project `privv` inside group `test`  \n1. Okta user credentials:  \nOkta dashboard url - [REDACTED]\n\nusername -  [REDACTED]\npassword - [REDACTED]\n\n2.  After login, click **gitlab-group** app to initiate sso. You will be redirected to login to gitlab instance.\n\nGitlab instance user credentials  \nusername - [REDACTED]\npassword - [REDACTED]\n\n3. You will be redirected and gets an authorization screen, don't authorize yet\n\n4. Open burp and keep intercept ON  \n5. Now, click on authorize and change the parameter `?group_path=test` to `?group_path=group-two%2ftest`   \nand forward it.  \n6. Continue the saml flow without any more changes. After sso flow is completed you will gain access to the group `test` and also private project inside it named `test/privv`\n\n####  Impact\n\nOld SAML SSO still active so users part of the idP can still SSO into new private group which belongs to different owners\n\nPrevious kicked out owner can again become owner and new owner can't stop because saml settings are invisible\n\nBilling is associated with the parent group so when the group with SAML SSO transfer to the parent group on free plan, SSO still works and allows paid feature group SAML SSO and SCIM to use as free\n\nSince, group SAML SSO becomes invisible SCIM token can longer be reset so in case when SCIM token is known to previous users or got leaked  \nthen token can be used to create new users in the group with higher permissions\n\nThanks!\n\n## Attachments\n\n**Warning:** Attachments received through HackerOne, please exercise caution!\n\n## How To Reproduce\n\nPlease add [reproducibility information] to this section:\n\n1.\n1.\n1.\n\n[reproducibility information]: https://about.gitlab.com/handbook/engineering/security/#reproducibility-on-security-issues","title":"Transferred group to new owner / namespace - Allowing unauthorized SSO and SCIM token misused","time_estimate":0,"total_time_spent":0,"human_time_estimate":null,"human_total_time_spent":null,"state":"closed","milestone_id":2745650,"updated_by_id":9043659,"created_at":"2022-12-07T10:54:49Z","updated_at":"2023-06-20T14:13:04Z","milestone":{"id":2745650,"iid":84,"group_id":9970,"title":"15.9","description":"","state":"closed","created_at":"2022-08-22T16:58:02.303Z","updated_at":"2024-01-11T08:46:48.987Z","due_date":"2023-02-17","start_date":"2023-01-18","expired":true,"web_url":"https://gitlab.com/groups/gitlab-org/-/milestones/84"},"labels":[{"id":992791,"title":"Deliverable","color":"#428BCA","description":"Issues scheduled for the current milestone.","text_color":"#FFFFFF","created_at":"2016-11-18T17:02:50.145Z","updated_at":"2019-04-17T18:49:16.998Z","group_id":9970,"project_id":null,"template":false},{"id":3417347,"title":"HackerOne","color":"#0033CC","description":"","text_color":"#FFFFFF","created_at":"2018-01-31T13:53:42.609Z","updated_at":"2019-01-09T12:13:21.325Z","group_id":9970,"project_id":null,"template":false},{"id":16845059,"title":"Weakness::CWE-284","color":"#7F8C8D","description":"Improper Access Control - Generic","text_color":"#FFFFFF","created_at":"2020-10-27T18:02:21.437Z","updated_at":"2020-10-27T18:02:21.437Z","group_id":9970,"project_id":null,"template":false},{"id":4107753,"title":"bug::vulnerability","color":"#cc0000","description":"A security vulnerability","text_color":"#FFFFFF","created_at":"2018-05-22T15:15:09.960Z","updated_at":"2025-05-30T17:22:54.906Z","group_id":9970,"project_id":null,"template":false},{"id":4116705,"title":"devops::foundations","color":"#e44d2a","description":"Issues for the Foundations stage of the DevOps lifecycle (e.g. Import \u0026 Integrate, Personal Productivity, etc)","text_color":"#FFFFFF","created_at":"2018-05-23T15:35:30.635Z","updated_at":"2024-08-13T17:20:38.144Z","group_id":9970,"project_id":null,"template":false},{"id":10046105,"title":"group::authentication and authorization [DEPRECATED]","color":"#a8d695","description":"Issues belonging to the Authentication and Authorization group of the Manage stage of the DevOps lifecycle. See https://about.gitlab.com/handbook/product/categories/#authentication-and-authorization-group","text_color":"#1F1E24","created_at":"2019-03-24T00:26:10.361Z","updated_at":"2023-10-17T19:50:29.968Z","group_id":9970,"project_id":null,"template":false},{"id":3857529,"title":"priority::3","color":"#fff600","description":"We want to address this but may have other higher priority items. See https://handbook.gitlab.com/handbook/product-development/how-we-work/issue-triage/#priority","text_color":"#1F1E24","created_at":"2018-04-13T08:02:52.659Z","updated_at":"2026-05-27T12:21:30.842Z","group_id":9970,"project_id":null,"template":false},{"id":14918378,"title":"section::dev","color":"#F0AD4E","description":"Issues related to the Dev section","text_color":"#1F1E24","created_at":"2020-05-11T22:11:57.167Z","updated_at":"2020-05-11T22:11:57.167Z","group_id":9970,"project_id":null,"template":false},{"id":2779335,"title":"security","color":"#d9534f","description":"Issues related to the security of GitLab or its dependencies. Please report vulnerabilities responsibly per https://about.gitlab.com/security/disclosure/","text_color":"#FFFFFF","created_at":"2017-10-05T14:36:39.341Z","updated_at":"2023-05-24T20:20:05.269Z","group_id":9970,"project_id":null,"template":false},{"id":3713901,"title":"severity::3","color":"#fff600","description":"Major - applies to bugs and bug categories of availability, performance, security and ux. See https://handbook.gitlab.com/handbook/product-development/how-we-work/issue-triage/#severity","text_color":"#1F1E24","created_at":"2018-03-23T14:46:22.464Z","updated_at":"2026-05-27T12:20:26.672Z","group_id":9970,"project_id":null,"template":false},{"id":2278648,"title":"type::bug","color":"#cc0000","description":"Issues that report undesirable or incorrect behavior. See https://handbook.gitlab.com/handbook/product/groups/product-analysis/engineering/metrics/#work-type-classification","text_color":"#FFFFFF","created_at":"2017-07-07T20:20:34.868Z","updated_at":"2024-11-08T09:52:16.699Z","group_id":9970,"project_id":null,"template":false},{"id":22408318,"title":"workflow::awaiting security release","color":"#6699cc","description":"This is a security issue that is ready to be deployed but awaiting a security release","text_color":"#FFFFFF","created_at":"2021-11-02T16:15:28.794Z","updated_at":"2021-11-02T16:15:28.794Z","group_id":9970,"project_id":null,"template":false}],"lock_version":2,"author_id":2741139,"confidential":false,"discussion_locked":null,"assignees":[{"id":11811081,"username":"sgarg_gitlab","public_email":"","name":"Smriti Garg","state":"active","locked":false,"avatar_url":"https://gitlab.com/uploads/-/system/user/avatar/11811081/avatar.png?v=1789603685","web_url":"https://gitlab.com/sgarg_gitlab"}],"due_date":"2023-02-26","project_id":278964,"moved_to_id":null,"duplicated_to_id":null,"web_url":"/gitlab-org/gitlab/-/work_items/385050","current_user":{"can_create_note":false,"can_create_confidential_note":false,"can_update":false,"can_set_issue_metadata":false,"can_award_emoji":false},"create_note_path":"/gitlab-org/gitlab/notes?target_id=119998164\u0026target_type=issue","preview_note_path":"/gitlab-org/gitlab/-/preview_markdown?target_id=385050\u0026target_type=Issue","is_project_archived":false,"issue_email_participants":[],"type":"ISSUE","weight":3}