Exposed GitLab project email addresses let attackers push code
Summary
Attackers are exploiting exposed private GitLab project email addresses by adding them to READMEs, contributing guides, and bug report pages. This allows malicious actors to push arbitrary code to these projects disguised as legitimate submissions.
IFF Assessment
This vulnerability allows attackers to inject malicious code into private GitLab projects, posing a direct threat to code integrity and developer security.
Severity
This vulnerability has a high impact as it allows for remote code execution within a private project, and it is relatively easy to exploit by simply submitting a crafted payload via email.
Defender Context
This highlights a critical risk for developers using GitLab, where exposed contact information can be weaponized. Defenders should be vigilant about how project information is exposed and consider implementing stricter validation on incoming contributions, regardless of their source.