Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domain Analysed #565883 Valid Input Validation and Logic – 2019-08-30 – 249 Steal private objects of other projects via project import Analysed #743953 Valid Insecure Direct Object Reference – 2022-06-07 $20,000 254 Privilege escalation from any user (including external) to gitlab admin when admin impersonates you Analysed #493324 Valid Access Control – 2020-08-26 – 256 Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd parties Analysed #922456 Valid Authentication – 2020-10-01 $3,000 257 Cross-site Scripting (XSS) - Stored in RDoc wiki pages Analysed #662287 Valid Misconfiguration and Insecure Design – 2019-12-16 $3,500 282 Stored XSS via Kroki diagram Analysed #1731349 Valid Cross-site Scripting – 2023-06-02 $13,950 295 An attacker can run pipeline jobs as arbitrary user Analysed #894569 Valid Input Validation and Logic – 2020-08-26 $12,000 307 Stored XSS in markdown via the DesignReferenceFilter Analysed #1212067 Valid Cross-site Scripting – 2021-10-18 $16,000 317 Arbitrary file read via the bulk imports UploadsPipeline Analysed #1439593 Valid File and Path Handling – 2022-03-21 $29,000 329 Server Side Request Forgery mitigation bypass Analysed #632101 Valid Server-Side Request Forgery – 2020-04-18 – 350 Attacker is able to access commit title and team member comments which are supposed to be private Analysed #502593 Valid Access Control – 2019-07-03 – 351 SSRF on project import via the remote_attachment_url on a Note Analysed #826361 Valid Server-Side Request Forgery – 2020-06-07 $10,000 359 Bypass of GitLab CI runner slash fix in YAML validation Analysed #409395 Valid Input Validation and Logic – 2019-04-10 – 363 JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions Analysed #509924 Valid Information Disclosure – 2019-04-20 $12,000 366 RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag) Analysed #1609965 Valid Command and Code Injection – 2022-09-13 $33,510 387 Remote Command Execution via Github import Analysed #1679624 Valid Command and Code Injection – 2022-10-06 $33,510 392 gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be read Analysed #850447 Valid Information Disclosure – 2020-06-08 $10,000 410 RCE via unsafe inline Kramdown options when rendering certain Wiki pages Analysed #1125425 Valid Command and Code Injection – 2021-04-20 $20,000 427 Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests Analysed #689314 Valid Access Control – 2019-11-27 $12,000 457 RCE when removing metadata with ExifTool Analysed #1154542 Valid Command and Code Injection – 2021-05-14 $20,000 508 Local files could be overwritten in GitLab, leading to remote command execution Analysed #587854 Valid Command and Code Injection – 2019-07-17 $12,000 542 Stored XSS in Wiki pages Analysed #526325 Valid Cross-site Scripting – 2019-09-02 – 633 Exfiltrate and mutate repository and project data through injected templated service Analysed #446585 Valid Access Control – 2019-03-05 $11,000 762 Git flag injection - local file overwrite to remote code execution Analysed #658013 Valid Command and Code Injection – 2019-12-19 $12,000 777 Arbitrary file read via the UploadsRewriter when moving and issue Analysed #827052 Valid File and Path Handling – 2020-04-27 $20,000 1,503