A long-lived GitLab incoming email token embedded in project email addresses for the “Email work item” feature can be exploited to push attacker-controlled code, create merge requests, and trigger CI/CD pipelines using the permissions of the token owner. This issue can also bypass GitLab’s IP restrictions, as incoming email is explicitly excluded from those controls. […]

The post GitLab Email Token Lets Attackers Push Code to Main and Execute CI/CD Jobs appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Divya

Source: gbHackers
Source Link: https://gbhackers.com/gitlab-email-token/