GitLab · Report #415238
[Admin Panel] CSRF to resume/pause runner
Validstatus
lowseverity
60upvotes
1 Dec 2020disclosed
How it was found
Hi,
Just found a CSRF in admin panel of gitlab instance to pause/resume runner.
Steps to reproduce
- http://{gitlab_instance}/admin/runners/:runner_id/resume
- http://{gitlab_instance}/admin/runners/:runner_id/pause
Video:
███████
password: ██████████
Impact
Just found a CSRF in admin panel of gitlab instance to pause/resume runner.