A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You
Summary
A leaked private email address in GitLab allows anyone to push code and run CI/CD jobs in a user's name. This email address, intended for filing issues, acts as a credential, enabling unauthorized users to commit patches to any branch, including the main branch, and initiate automated workflows.
IFF Assessment
This vulnerability allows unauthorized code commits and execution of CI/CD jobs, directly impacting the integrity and security of code repositories and development pipelines.
Severity
The vulnerability allows for unauthorized code commits and execution of CI/CD jobs, impacting integrity and availability, with a potential for widespread impact across projects. The attack vector is likely network-based and requires minimal privileges (just knowledge of the email address).
Defender Context
This highlights a critical security flaw in GitLab's email issue functionality, where a private email address effectively becomes a sensitive credential. Defenders should be aware of this vulnerability and ensure that access to these email addresses is strictly controlled and monitored to prevent unauthorized code commits and pipeline abuse. Organizations using GitLab should review their configurations and consider alternative methods for issue submission if this feature is deemed too risky.