Stored-XSS with CSP-bypass in Merge requests
:warning: **Please read [the process](https://gitlab.com/gitlab-org/release/docs/-/blob/master/general/security/developer.md) on how to fix security issues before starting to work on the issue. Vulnerabilities must be fixed in a security mirror.** **[HackerOne report #1965750](https://hackerone.com/reports/1965750)** by `yvvdwf` on 2023-04-28, assigned to @rshambhuni: [Report](#report) | [How To Reproduce](#how-to-reproduce) ## Report Hi, Gitlab recently [added icon to indicate fork](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/116284) in the Merge requests page. This modification indicates `source_branch` as `html_safe`, which can cause XSS: ```ruby ### https://gitlab.com/gitlab-org/gitlab/-/blob/f728534d7f6a357cf049cfd7a640a32504a1b9d6/app/helpers/merge_requests_helper.rb#L251 branch_title = if merge_request.for_fork? _('%{source_project_path}:%{source_branch}').html_safe % { source_project_path: merge_request.source_project_path.html_safe, source_branch: merge_request.source_branch.html_safe } else merge_request.source_branch end ``` ### Reproduce 1. Within the current user, e.g., `user_a`, create a public project `user_a/a` 2. Switch to another user, e.g., `user_b`: 2.1. Fork `https://gitlab.com/user_a/a` to a public project `user_b/b` 2.2. Clone `user_b/b` to your local machine using `ssh`: `git clone git@gitlab.com:user_b/b` 2.3. Push a new branch to `user_b/b`: ```bash git clone git@gitlab.com:user_b/b cd b git push origin HEAD:"XSS<i/class=hidden><form/class=gl-show-field-errors><input/title='<script>alert(document.domain)</script>'>" ``` 2.4. Back to the website gitlab.com, create a new merge request from the created branch above to `user_a/a` 2.5. After creating the merge request, you should see a popup that is created by `<script>alert(document.domain)</script>` 3. The XSS should be existing at: `https://gitlab.com/user_a/a/-/merge_requests/1` 4. Example: https://gitlab.com/yvvdwf/test-xss-in-merge-request-via-fork/-/merge_requests/1 (in private mode) #### Impact Stored-XSS with CSP-bypass allows attackers to execute arbitrary actions on behalf of victims at the client side. ## How To Reproduce Please add [reproducibility information] to this section: 1. 1. 1. [reproducibility information]: https://about.gitlab.com/handbook/engineering/security/#reproducibility-on-security-issues
issue