GitLab Email Addresses Can Be Weaponized for Supply Chain Attacks
A GitLab vulnerability allows attackers to weaponize email addresses to conduct supply chain attacks. The platform automatically assigns users unique email addresses that contain non-expiring tokens granting broad access to projects, even pushing code to private repositories. Despite GitLab’s UI stating the addresses are only for issue creation, researchers have demonstrated that attackers can bypass IP restrictions and manipulate email addresses to gain unauthorized access and modify code. GitLab has since updated its UI and documentation to reflect these risks, but proactive measures like rotating access tokens and scanning for exposed addresses are recommended.
A GitLab vulnerability has been discovered that allows attackers to exploit email addresses for supply chain attacks. The platform automatically assigns each user a unique incoming email address to create issues within their software projects. However, these email addresses contain non-expiring tokens that provide broad access to an organization’s resources – not just the project in which an individual user is working.
Researchers at Aikido Security found that these email addresses can be used to bypass IP address restrictions and push malicious code to private projects. GitLab’s UI initially stated that the addresses were only for issue creation, but Aikido demonstrated that attackers could easily modify the email address to reach other private projects by adjusting the project path slug and project ID.
GitLab has since updated its UI to reflect that the email addresses can be used for merge requests and removed the misleading statement that they cannot be used to access other data. They have also updated their documentation to inform users about the risks. Aikido reported its findings to GitLab through HackerOne in May, and followed up in June with a confidential issue on the GitLab repository.
To mitigate this risk, Aikido recommends organizations proactively rotate access tokens in their GitLab email addresses and scan for these addresses in their development environments and repositories. GitLab is considering a change that would require the sender address to match the one on the GitLab account, which would significantly reduce the attack surface.