Internal Gitlab Ticket Disclosure via External Slack Channels

Summary

@none_of_the_above was able to enumerate GitLab ticket titles and descriptions by posting links in a shared Slack channel. As part of HackerOne's investigation, it was determined that the misconfiguration could also be used to obtain the contents of exceptions from HackerOne's production environment that were captured in Sentry. Limited access to information in these two systems led to the conclusion that this was a high severity vulnerability.

No confidential information or customer information was accessed by @none_of_the_above in their proof of concept of the vulnerability. We'd like to thank @none_of_the_above for their efforts and diligence in disclosing this vulnerability to us.

HackerOne Pentest Team is a group of external hackers who are selected to perform specific engagements on HackerOne. As part of this team, I have access to a Slack Workspace which is used to coordinate engagements and communicate with customers. On July 22nd I replied to a message from another pentester who was reporting a functional bug on the platform. In my reply, I included a Gitlab link with the intention of pointing out that his report was a duplicate of an internal issue which had already been reported by another hacker. I noticed that the link automatically displayed a preview of the internal ticket, which of course, should only be seen by employees. Since Gitlab issue IDs are sequential, I tried iterating the IDs and discovered that I could access partial info from any internal Gitlab issue. The engineering team promptly implemented a fix and even discovered other ways in which this vulnerability may have been abused.