GitLab Email Addresses Can Enable Code Changes

GitLab’s incoming-email feature can let anyone who obtains a user’s project email address submit code changes under that user’s permissions, including to branches such as main when the account is authorized to push there, according to research by Aikido Security. The company also found that the email route can bypass project IP restrictions. GitLab updated its descriptions of the feature after Aikido reported its findings, but the reported behavior remains unchanged. The addresses are provided for users to create project issues by email. Aikido says each contains a nonexpiring token shared across the projects accessible to the account, rather than a credential limited to the project shown in the address. GitLab processes messages sent to the address as actions by the account owner and does not verify that the sender’s email address belongs to that user. Aikido demonstrated that changing the address’s suffix to use GitLab’s merge-request-by-email function could allow someone with the address to submit a patch. The changes that can be made depend on the account holder’s permissions: the token does not grant rights beyond those the user already has.