Arbitrary file read in project uploads controller via path traversal

⚠ Please read the process on how to fix security issues before starting to work on the issue. Vulnerabilities must be fixed in a security mirror.

HackerOne report #1994725 by pwnie on 2023-05-20, assigned to H1 Triage:

Report

The project uploads controller is vulnerable to path traversal in the :filename parameter which leads to arbitrary file reads

Create a new group and recursively create 10 new subgroups
Example: http://gitlab.com/11/22/33/44/55/66/88/99/aa/bb/cc/dd/ notice the deeply nested subgroups and a project at the end (dd)

1.5 If you don't want to do this step you can just use mine: https://gitlab.com/11753220/22/33/44/55/66/77/88/99/10/11

Arbitrary file read

:filename can contain path traversal characters

Sanitize :filename

The bug happens on Gitlab

Arbitrary file read

Warning: Attachments received through HackerOne, please exercise caution!

Please add reproducibility information to this section:

Edited Jun 26, 2023 by Rohit Shambhuni