Importing GitLab project archives can replace uploads of other users
不安全的直接对象引用 / IDOR / #534794
该报告还没有中文解读。
原文摘录
摘自原文（4650 字符中的一小部分）
Summary Importing a modified exported GitLab project archive can overwrite uploads for other users. If the `secret` and `file name` of an upload are known (these can be easily identified for any uploads to public repositories), any user can import a new project which overwrites the served content …
原文中的代码
Started GET "/root/new_project/uploads/ed5ab56bc85699117ba230eb799fd3bf/indi.jpg" for 127.0.0.1 at 2019-04-10 23:07:12 +0000
Processing by Projects::UploadsController#show as HTML
Parameters: {"namespace_id"=>"root", "project_id"=>"new_project", "secret"=>"[FILTERED]", "filename"=>"indi.jpg"} …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 GitLab 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @ajxchapman · 版权归作者与 GitLab 所有