Adding everyone to the repo due to the lack of rate limit

Disclosed: 2020-09-14 23:28:30 By sadd_man To gitlab
High
Vulnerability Details
### Summary Since there is no rate limit in the inviting users to the repository section, it is possible to add all users on gitlab to a repository. ### Steps to reproduce (Step-by-step guide to reproduce the issue, including:) 1. Create a repository 2. go to the project members section 3. choose a random user 4. before clicking the invite button, we need to capture the request with the burp suite.. 5. ███████ 6. Send it to the Intruder module, specify the █████ field here between 1 and 7006996 and send the request. ### Impact It is possible to collect all users on Gitlab in a single repository, so users' mailboxes will be filled with notifications. ### Note Because the rate limit is out of scope, I tested it and I could not stop the python script, and there were users affected. ## Impact It is possible to collect all users on Gitlab in a single repository, so users' mailboxes will be filled with notifications.
Actions
View on HackerOne
Report Stats
  • Report ID: 978768
  • State: Closed
  • Substate: not-applicable
  • Upvotes: 7
Share this report