Skip to content

Removed Developer can continue editing the source code of a public project

⚠ Please read the process on how to fix security issues before starting to work on the issue. Vulnerabilities must be fixed in a security mirror.

HackerOne report #2082560 by theluci on 2023-07-24, assigned to GitLab Team:

Report | Attachments | How To Reproduce

Report

Hello,

Background

Gitlab provides a feature to create a fork of a project.

Gitlab also provides a feature to Collaborate on merge requests across forks. This feature allows upstream members to collaborate with you on your branch, when this option is enabled members who have permission to merge to the target branch get permission to write to the merge request’s source branch.

According to docs,

8july-4.png

Vulnerability

When a merge request is created from a public project victim-project to one of its forks victim-project-fork (Public project but merge requests has been set as Only Project Members), Only the members of the victim-project-fork has the ability to view, edit as well as delete the merge request.

A malicious developer of victim-project can utilize the above to create a merge request from victim-project to victim-project-fork with collaboration option enabled and continue affecting the integrity of victim-project even after malicious developer has been removed.

Attack flow looks as follows,

  • victim is the Owner of public project victim-project
  • attacker is a Developer of victim-project
  1. attacker creates a public fork of victim-project in his Personal namespace victim-project-fork.
  2. attacker goes to victim-project-fork settings and set Merge requests as Only Project Members.
  3. attacker creates merge requests from every non-protected branch in victim-project to their respective branches in victim-project-fork with collaboration option enabled.
  4. attacker is removed from victim-project.
  5. victim cannot view or delete the merge requests in victim-project-fork.
  6. attacker continues to be able to edit the source code of victim-project using open merge requests in victim-project-fork.

Steps to reproduce

  1. victim creates a public group victim-group and a public project victim-project inside.
  2. victim goes to victim-group membership page https://gitlab.com/groups/<victim-group>/-/group_members and adds attacker as Developer.
  3. victim goes to victim-project and creates branch another-branch.
  4. attacker goes to victim-project and creates a public fork in his Personal namespace victim-project-fork.
  5. attacker goes to victim-project-fork settings https://gitlab.com/<attacker_username>/<victim-project-fork>/edit, Expand Visibility, project features, permissions and set Merge requests as Only Project Members.
  6. attacker goes to https://gitlab.com/<victim-group>/<victim-project>/-/merge_requests/new and creates a merge request from another-branch in victim-project to another-branch in victim-project-fork with collaboration option enabled.

9july-1.png

In a real-world scenario, attacker will create merge requests from every non-protected branch in victim-project to their respective branches in victim-project-fork with collaboration option enabled.

  1. victim removes attacker from victim-group.

victim is not able to view or delete the merge requests in victim-project-fork and has no idea merge requests with collaboration option enabled exists.

attacker continues to be able to edit the source code of victim-project using open merge requests in victim-project-fork.
8. attacker visits victim-project
9. attacker is able to make changes to another-branch in victim-project

  • To create a new file, attacker switches to another-branch and create the file using + symbol.
  • To edit an existing file attacker goes to the following API endpoint,
https://gitlab.com/<victim-group>/<victim-project>/-/edit/another-branch/<file_name>

As can be seen, attacker continues to be able to edit the source code of victim-project.

POC

24july-2.mp4

Output of checks

This bug happens on GitLab.com (Probably on instance too).

Impact

A Removed Developer can continue editing the source code of a public project

Attachments

Warning: Attachments received through HackerOne, please exercise caution!

How To Reproduce

Please add reproducibility information to this section: