A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You
-
GitLab provides each user with a private email address for filing issues by email, and that address functions as a credential. Anyone who obtains it can send an email containing a patch that GitLab commits under the victim's name, targeting any branch the user is permitted to push to, including main. The same access allows the attacker to trigger CI/CD jobs that execute with the victim's privileges.
The address is exposed in the GitLab interface behind a button labeled "Email work item to this project." Mail sent to it opens an issue in the corresponding project, with the message authored as the victim.
Key points:
- The issue-by-email address is effectively a secret credential and should be treated as such.
- A leaked address permits commits to any branch the user can push to, including main.
- It also permits starting CI/CD jobs that run as the affected user.
- GitLab surfaces the address through the "Email work item to this project" button.
Mitigation considerations:
- Treat your project's incoming issue email address as sensitive; avoid sharing it in public channels, screenshots, or documentation.
- Rotate the address if you suspect it has been exposed.
- Review project and branch permissions to limit what a compromised address could reach.
Source: [email protected] (The Hacker News)
Has your organization reviewed who can access your GitLab issue-by-email addresses?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login