TechPrufer
Get started
GitLab
GitLab logoGitLab · Feature trail

API Security Vulnerability Research

2 posts · May 2018 – Aug 2022

What this trail covers

GitLab has evolved its API security by deprecating and removing older API versions (v3) in favor of newer, more secure versions (v4). This ensures that integrations are using the latest security standards and features, reducing potential vulnerabilities and improving overall API robustness. The process involves clear communication and documentation for users to upgrade their integrations, minimizing downtime and ensuring a smooth transition to more secure API endpoints. This integration with Pos

All GitLab trails
  1. Postman integration with GitLab makes API workflows easierThis post details the integration between Postman and GitLab, enabling users to link Postman APIs to GitLab repositories. Key benefits include introducing version control concepts (branches, releases, versions, tags) into Postman, allowing Postman elements to be pushed to GitLab repositories alongside source code, enabling review and merging of external changes back to Postman, and providing a unified view of the API lifecycle (code, definitions, documentation, tests, etc.). This integration aims to reduce the likelihood of consumers interacting with outdated APIs by providing a clear version history and direct access to collaborative tools like commenting and forking/merging.
  2. Using the GitLab GraphQL API for vulnerability reportingThis post details how to use the GitLab GraphQL API to create and manage vulnerabilities. It demonstrates creating a vulnerability via a `curl` request and then outlines the steps to build a GoLang web application deployed on Kubernetes that utilizes the GitLab Kubernetes Agent to report vulnerabilities through a web form. This expands the API's utility beyond direct scripting to enabling a user-friendly interface for vulnerability reporting.
  3. Shopping for an admin account via path traversalThis post details a path traversal vulnerability in the GitLab Customers Portal that allowed an attacker to inject attributes into API calls, enabling privilege escalation to admin on gitlab.com. The vulnerability was mitigated by enforcing numerical IDs for the `@namespace_id` parameter and implementing additional defense-in-depth measures.
  4. Breaking change: Support for API v3 will be removed June 4This post announces the removal of API v3 on June 4, 2018, and its complete removal in GitLab 11.0 on June 22, 2018. It urges users to upgrade integrations to API v4 before June 4 to avoid downtime and provides a link to upgrade documentation.