GitLab's Issue Email Feature Vulnerable to Exploitation

GitLab's introduction of a project-specific email address aimed to streamline issue creation for developers, but it inadvertently opens the door to significant security risks. Investigations by Aikido Security reveal that inadequate security measures and a persistent token embedded in these email addresses mean that anyone privy to the address can alter secured repositories. This makes project owners vulnerable, especially if they inadvertently share these addresses.

The email address, presented via a button labeled “Email work item to this project,” provides access that extends beyond its intended function, potentially granting account-wide permissions on both private and public projects. Aikido's findings suggest that this feature is automatically activated for all accounts on GitLab.com and is similarly enabled for self-hosted versions of GitLab, creating a widespread issue.

“If someone has that address, they can push code and execute CI/CD tasks across all projects accessible to the account,” stated Aikido in a blog post detailing their research. Joseph Leon, security researcher at Aikido, expressed that a simple adjustment, such as requiring the sender's 'from' address to match the GitLab user’s registered email, could significantly reduce these risks.

Ignoring IP Restrictions

While GitLab offers users the option to restrict access based on IP addresses, these limits do not extend to email submissions. Aikido pointed out that while their browser access was banned and git clone attempts were rejected, the email submission still succeeded, landing changes directly in the main branch.

This behavior, although intended, raises alarms about security protocols. Aikido argues that GitLab has effectively created a powerful credential that circumvents IP controls, packaging it as an email address. Vulnerable email addresses follow the format incoming+project-id-glimt-XXXXXXXXXXXXXX-issue@incoming.gitlab.com.

The security flaw lies primarily in the inclusion of a personal access token (PAT), denoted by the "glimt-" prefix within the email address, which GitLab advises users to keep confidential. The platform stresses, “Keep this token secret. Anyone who has it can create issues as if they were you.” However, Aikido critiques that the assertion claiming the token is limited to certain functionalities is misleading. Despite different email addresses for various projects, the same token is shared across all projects linked to the account, presenting a broader risk.

With just a minor revision to the token’s suffix, automated actions beyond creating issues could occur. An attacker could exploit this vulnerability to initiate a merge request, which would allow them to present a malicious code patch, potentially executing unwanted code within the project’s CI/CD pipeline.

Merge Request Capabilities

After Aikido shared these findings, GitLab updated the user interface description for the token to clarify that it enables not just issue creation but also the ability to submit merge requests.

However, the access provided is still governed by the permissions of the user's account tied to the secret email address. Leon clarified, “The level of impact hinges on the user’s permissions. If they can merge code or manage CI/CD pipelines for a project, the risks associated with the email address reflect that user’s rights, which could lead to serious consequences.”

Challenges arise when attempting to target projects beyond the owner's direct access, as attackers would need to ascertain private project identifiers, which are generally kept confidential, though project paths are frequently public. “I’ve uncovered several exposed email addresses in just a few hours of searching, including some from well-known open source projects like wget2,” Leon remarked.

Aikido's recommendation emphasizes treating these email addresses as sensitive credentials. Organizations must proactively scan for exposed email addresses in public spaces and documentation. If any leaks are suspected, promptly resetting the email token is essential to protect associated addresses.

This article first appeared on InfoWorld.