Exposed GitLab Email Addresses Could Let Attackers Push Code

Private GitLab email addresses used to create project issues or tasks are being exposed in public documentation, researchers at application security company Aikido warn. The addresses belong to GitLab’s “Email work item to this project” feature and contain a long-lived token tied to a developer’s account.

When someone emails one of these addresses, GitLab turns the message into an issue or task. Aikido says an attacker who obtains an address could change its “-issue” suffix to “-merge-request” to open a merge request. The researchers also found that this method could bypass IP address restrictions. Any changes an attacker can make still depend on the account’s permissions; the attacker also needs the project’s path and ID.

In one afternoon, Aikido researchers found a dozen live incoming email addresses in public READMEs, contributing guides, and support pages. They said the addresses had been deliberately included to collect bug reports, and that some belonged to popular open-source projects.

Aikido reported the issue to GitLab through HackerOne in May. GitLab closed the report as “intended behavior.” After a second notification in June, GitLab updated its interface and documentation to mention merge requests and the IP restriction bypass.

GitLab’s documentation warns that anyone who knows a private address can create issues or merge requests as its owner, and advises resetting the token if the address may have leaked. Aikido recommends that maintainers stop publishing these addresses and reset tokens they previously exposed.