Exposed GitLab project email addresses let attackers push code
-
A security concern has emerged around GitLab project email addresses that are meant to stay private. These addresses allow developers to push issues or tasks directly to a project, and they are being deliberately exposed in public-facing content such as READMEs, contributing guides, and support pages used to collect bug reports.
Because these email addresses can be used to push code and create issues or tasks, their exposure gives attackers a potential path into projects that rely on them. The exposure appears to stem from the addresses being published openly in documentation and support channels rather than through any single flaw in GitLab itself.
- Affected locations include READMEs, contributing guides, and support pages used for bug reports
- The exposed addresses can be used to push issues or tasks to a project
If your organization uses GitLab project email addresses for issue or task submission, it is worth reviewing your public documentation and support pages to confirm these addresses are not exposed where they should remain private.
Source: BleepingComputer
Have you checked whether your project's private GitLab email addresses are leaking in public documentation or support pages?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login