Veille cybersecurite : A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You
Source : The Hacker News
The private email address GitLab gives you for filing issues by email is a credential. Anyone who gets it can email a patch that GitLab commits in your name, to any branch you can push to, including main, and can start CI/CD jobs that run as you.
GitLab shows each user this address behind a button labeled « Email work item to this project. » Mail sent to it opens an issue in that project, authored
Vous vous demandez si votre entreprise est exposee a ce type de faille ? Reservez un appel decouverte gratuit.