Summary
GitLab's incoming email feature uses a persistent, account-wide token that allows attackers to push code, run CI/CD jobs, and bypass IP restrictions if the address is leaked. The mechanism inherits user permissions and lacks sender verification, making it a vector for supply chain attacks.
Take Action:
If you use GitLab, treat your "email to project" address like a password: go to your personal access tokens page, reset your incoming email token, and remove any of these addresses you've posted in READMEs, docs, or tickets. Don't assume IP restrictions or two-factor authentication protect you from this.. If you run your own GitLab server with no real need for issue-by-email, turn off incoming email entirely.
Read the full article on BeyondMachines
This article was originally published on BeyondMachines
Top comments (0)