**[HackerOne report #1778009](https://hackerone.com/reports/1778009)** by `st4nly0n` on 2022-11-18, assigned to `Ottilia Westerlund`: [Report](#report) | [Attachments](#attachments) | [How To Reproduce](#how-to-reproduce) ## Report   Summary ===================== The default branch name for a group is not being validated correctly, when uploading a file from the web interface, a **POST** request is issued that includes in the request path the default branch name of a group. ```bash POST /any_path HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 Firefox/106.0 Accept: application/json, text/plain, */* Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://localhost/user/repo X-CSRF-Token: REDACTED X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------367269929429674248332090673842 Content-Length: 653 Origin: http://localhost Connection: close Cookie: _gitlab_session=REDACTED; event_filter=all -----------------------------367269929429674248332090673842 Content-Disposition: form-data; name="branch_name" ../../../../../any_path -----------------------------367269929429674248332090673842 Content-Disposition: form-data; name="create_merge_request" true -----------------------------367269929429674248332090673842 Content-Disposition: form-data; name="commit_message" Upload New File -----------------------------367269929429674248332090673842 Content-Disposition: form-data; name="file"; filename="anyfile.txt" Content-Type: text/plain -----------------------------367269929429674248332090673842-- ``` This allows to place in the main branch name a path with traversal path to any api endpoint and issue **POST** requests with the current session. The endpoint `/api/v4/projects/<ID-VICTIM-PROJECT>/import_project_members/<ID-ATTACKER-PROJECT>`, allows importing members from one project to another, if the victim issues a **POST** request to this endpoint it would be importing the members with the source permissions to the target repository. An attacker can take over the victim's repository through the use case where a victim decides to use the web interface to upload a file to an empty repository to which he was invited.   Steps to reproduce: ===================== **•** *Perform the steps below as the victim user:* **1.** The user `owner` creates a public repository named `project_victim`.   **•** *Perform the following steps as the attacker user:* **1.** Create two accounts `attacker1` and `attacker2`. **2.** `attacker1` creates a public group called `attacker_group` **3.** `attacker1` creates an empty public project *(uninitialized README.md)* named `attacker_project` inside the `attacker_group` group. **4.** `attacker1` changes the default branch name for the `attacker_group` group to the following value: ```bash ### branch name obfuscated main.182BB2A57D285B692BB93108E937f12bbfe9c15748A8A271dc238B895683B34D2273571f8753cbb9fB466CF4D395da5fe784340150e485f3378f01d2450ff7eed56308c0f6f4ebc364189714C1f74140f97../../../../../../api/v4/projects/<ID-VICTIM-PROJECT>/import_project_members/<ID-ATTACKER-PROJECT> ``` where `ID-VICTIM-PROJECT` is the project id of `project_victim` and `ID-ATTACKER-PROJECT` is the project id of `attacker_project`. **5.** `attacker1` invites `attacker2` to the `attacker_project` repository, and gives him the role of owner. **6.** `attacker1` invites user `owner` to the `attacker_project` project and grants him the role of maintainer. **7.** the `owner` user uses the web interface to upload a file to the `attacker_project`. As a result of this behavior, user `attacker2` owns the project `project_victim` project. The attack also succeeds if the `owner` user is replaced by a maintainer user of the project `project_victim` project, since a maintainer can import members from other projects.   What is the current *bug* behavior? =========================== A victim using the web interface to upload a file to an empty repository to which he was invited would be granting access to any user within the victim's repository.   What is the expected *correct* behavior? =========================== You must validate the main branch name for a group correctly, git does not allow a branch name like this '../../'.   Relevant logs and/or screenshots =========================== The following video shows the attack starting from step 7 in the steps to replay, see how the victim decides to use the web interface to upload a file to an empty repository to which he was invited, this allowed an attacker to own a repository of the victim.    Output of checks =========================== This bug happens on GitLab.com   #### Impact An attacker can take control of any victim's repository, using the use case where a victim decides to use the web interface to upload a file to a repository to which he was invited. ## Attachments **Warning:** Attachments received through HackerOne, please exercise caution! * [poc.mp4](https://h1.sec.gitlab.net/a/c44e941a-55ca-4ba0-a727-5c06ebe1c36b/poc.mp4) ## How To Reproduce Please add [reproducibility information] to this section: 1. 1. 1. [reproducibility information]: https://about.gitlab.com/handbook/engineering/security/#reproducibility-on-security-issues