Skip to content

Guests can disclose project templates using the REST API

⚠️ Please read the process on how to fix security issues before starting to work on the issue. Vulnerabilities must be fixed in a security mirror.

HackerOne report #2501461 by js_noob on 2024-05-11, assigned to @ottilia_westerlund:

Report | Attachments | How To Reproduce

Report

Summary

Hello team, project members can create templates in that project for easier accessibility, these templates are just code saved in "special" file paths in the project, i.e. they are part of the source code of a project. On the other hand, guests aren't allowed to read the code of a private project, so they shouldn't be able to access project templates. However, this is false, as guests can disclose all project templates using the REST API.

I understand that guests might still need access to issues templates, as guests are allowed to create issues, but they shouldn't have access to other types of templates, for example, merge request templates.

Steps to reproduce

As an owner:

  1. Create a new group and apply the ultimate trial to it
  2. Create a new private project in that group
  3. Create a new file having the path .gitlab/merge_request_templates/mytemplate.md, and any content in that file
  4. Invite a guest to the group

As the guest:

  1. Verify that you can't access the templates/code
  2. Send the following API calls:
curl --header "PRIVATE-TOKEN: PAT" "https://gitlab.com/api/v4/projects/PROJECT_ID/templates/merge_requests"  
curl --header "PRIVATE-TOKEN: PAT" "https://gitlab.com/api/v4/projects/PROJECT_ID/templates/merge_requests/TEMPLATE_NAME"
  1. Verify the disclosure of the content of the template
What is the current bug behavior?

Guests can access project templates through REST API.

What is the expected correct behavior?

Guests shouldn't be able to access project templates through REST API.

Output of checks

This bug happens on GitLab.com

Impact

Disclosure of project template to unauthorized users (guests).

How To Reproduce

Please add reproducibility information to this section:

Edited by Costel Maxim