GitLab · Report #475098
A profile page of a user can be denied from loading by appending .html to the username
Validstatus
lowseverity
$200bounty
26upvotes
30 Aug 2021disclosed
Summary
This class of bugs would be considered as Informative due to minimal security impact, as per latest program policy.
How it was found
Summary: I was able to create a user with the username "dashboard.html". Once, the account is set up, when the user clicks on his profile, the actual dashboard will show up instead of his profile page. Same can be done for all the HTML pages in GitLab.
Steps To Reproduce:
- Register a new user with "some_html_page_in_gitlab.html"
- After logging in. click on the profile tab, it will be redirected to the dashboard page.
- I even tried the username "profile.html", it is getting directed to the profile tab.
Impact
The major impact here I can think of is that a user can hide his profile from the public just by having a clowny username.