RESEARCH from Aikido Security says GitLab’s automatically assigned incoming email addresses can function as highly privileged, non-expiring access tokens. Users can email these addresses to create issues, but the embedded `glimt-` (GitLab Incoming Mail Token) credential can also be used to submit merge requests and patch files, including to projects beyond the one named in the address.
The same token applies across a user’s public and private projects, meaning an exposed address for a public project could potentially be altered to target private projects if the attacker knows the relevant project name. Aikido also found that email-submitted merge requests could bypass IP restrictions that blocked browser and Git access.
The research was based on testing rather than confirmed attacks. During a short, “very non-exhaustive” internet search, Aikido researcher Joe Leon found about a dozen deliberately exposed addresses in ReadMe pages and support files, including some linked to popular open-source projects. He warned that misuse, such as code poisoning, may be difficult to identify as email-based.
Aikido reported the issue to GitLab through HackerOne in May; GitLab closed it as intended behaviour, but later updated its interface and documentation to acknowledge merge-request functionality and the fact that IP restrictions do not apply. GitLab was considering requiring the sender’s address to match the GitLab account. Aikido recommends rotating the tokens and scanning repositories and development environments for exposed addresses.