GitLab issue email’s only security is obscurity
Summary
GitLab's 'email work item' feature, intended to simplify issue creation, has a significant security flaw. The feature embeds a long-lived token in a secret email address that, if exposed, allows anyone to push code and run CI/CD jobs in protected repositories, bypassing IP restrictions. GitLab considers this intended behavior, while researchers at Aikido Security argue it presents a critical risk.
IFF Assessment
The article highlights a vulnerability in GitLab's issue creation feature that could allow unauthorized access and modification of code repositories, posing a significant risk to defenders.
Severity
The vulnerability allows for unauthorized code execution and modification within any project accessible by the account, indicating a high impact. The attack vector is relatively simple (emailing a known address) and exploitability is high given the long-lived token and lack of robust authentication checks.
Defender Context
Defenders should be aware of this potential issue with GitLab's email-to-issue functionality and ensure that these generated email addresses are kept strictly confidential. It's crucial to audit access controls for repositories and monitor for any suspicious activity originating from these email addresses, as they can act as powerful credentials if exposed.