Remote Command Execution via Github import Analysed #1679624 Valid Command and Code Injection Critical 2022-10-06 $33,510 392 RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag) Analysed #1609965 Valid Command and Code Injection Critical 2022-09-13 $33,510 387 Arbitrary file read via the bulk imports UploadsPipeline Analysed #1439593 Valid File and Path Handling Critical 2022-03-21 $29,000 329 RCE via github import #1672388 Valid Command and Code Injection Critical 2022-11-16 – 271 Steal private objects of other projects via project import Analysed #743953 Valid Insecure Direct Object Reference Critical 2022-06-07 $20,000 254 Stored XSS in Notes (with CSP bypass for gitlab.com) Analysed #1481207 Valid Cross-site Scripting High 2022-05-25 – 161 Path traversal, to RCE Analysed #733072 Valid Command and Code Injection High 2022-06-07 $12,000 142 Private objects exposed through project import Analysed #767770 Valid Insecure Direct Object Reference Critical 2022-06-07 $20,000 133 Able to view hackerone reports attachments Analysed #979787 Valid Information Disclosure Critical 2022-07-11 – 103 CSP-bypass XSS in project settings page Analysed #1588732 Valid Cross-site Scripting High 2022-11-16 – 100 New /add_contacts /remove_contacts quick commands susseptible to XSS from Customer Contact firstname/lastname fields Analysed #1578400 Valid Cross-site Scripting High 2022-11-16 $13,950 93 RepositoryPipeline allows importing of local git repos Analysed #1685822 Valid Access Control Medium 2022-11-04 $22,300 89 Path traversal in Nuget Package Registry Analysed #822262 Valid File and Path Handling High 2022-06-07 $12,000 88 XSS in ZenTao integration affecting self hosted instances without strict CSP Analysed #1542510 Valid Cross-site Scripting High 2022-09-22 – 81 Content injection in Jira issue title enabling sending arbitrary POST request as victim Analysed #1533976 Valid Injection and Smuggling High 2022-09-22 – 55 Arbitrary POST request as victim user from HTML injection in Jupyter notebooks Analysed #1409788 Valid Injection and Smuggling High 2022-05-20 – 54 RCE via WikiCloth markdown rendering if the `rubyluabridge` gem is installed Analysed #1401444 Valid Command and Code Injection – 2022-04-12 $3,000 50 Improper access control for users with expired password, giving the user full access through API and Git Analysed #1285226 Valid Access Control Medium 2022-01-27 – 49 XSS: `v-safe-html` is not safe enough Analysed #1579645 Valid Cross-site Scripting High 2022-11-16 – 43 Stored XSS on issue comments and other pages which contain notes Analysed #1398305 Valid Cross-site Scripting High 2022-06-08 $3,000 38 Exposure of a valid Gitlab-Workhorse JWT leading to various bad things Analysed #1040786 Valid Authentication High 2022-07-05 $10,000 36 IDOR in "external status check" API leaks data about any status check on the instance Analysed #1372216 Valid Insecure Direct Object Reference Medium 2022-02-22 – 35 Stored XSS in merge request creation page through payload in approval rule name Analysed #1342009 Valid Cross-site Scripting High 2022-03-31 – 32 Stored XSS in repository file viewer Analysed #1072868 Valid Cross-site Scripting Medium 2022-05-19 $2,000 29 DOS via issue preview Analysed #1543718 Valid Denial of Service High 2022-11-04 $7,640 25 Stored XSS for Grafana dashboard URL Analysed #684268 Valid Cross-site Scripting High 2022-07-13 – 21 DOS via move_issue Analysed #1543584 Valid Denial of Service Medium 2022-11-04 $2,300 19 Unauthenticated IP allowlist bypass when accessing job artifacts through gitlab pages at `{group_id}.gitlab.io` Analysed #1591412 Valid Access Control Medium 2022-09-22 – 17 Sending Arbitrary Requests through Jupyter Notebooks on gitlab.com and Self-Hosted GitLab Instances #970869 Valid Command and Code Injection Medium 2022-02-10 – 15 Gitlab Pages token theft using service workers #1439552 Valid Access Control Medium 2022-06-08 $1,680 14 "External status checks" can be accepted by users below developer access if the user is either author or assignee of the target merge request #1375393 Valid Access Control Medium 2022-06-08 – 13 XSS by clicking Jira's link #1194254 Valid Cross-site Scripting Medium 2022-06-08 $1,130 12 ReDoS in net/http affects webhooks: Sidekiq job stuck at 100% CPU for a year #1531958 Valid Denial of Service Medium 2022-09-13 – 9 Installing Gitlab runner with Docker-In-Docker allows root access #1417211 Valid Access Control – 2022-02-10 $100 9 Path paths and file disclosure vulnerabilities at influxdb.quality.gitlab.net #1643962 Valid Information Disclosure Low 2022-11-04 – 8