Shopping for an admin account via path traversal
11/29/2019
This post details the discovery and exploitation of a path traversal vulnerability in the GitLab Customers Portal's interaction with the GitLab.com API. The vulnerability allowed an attacker to traverse API paths and inject attributes, leading to privilege escalation by promoting regular accounts to admin. The post also outlines the mitigation strategy, which involved enforcing numerical IDs for the `@namespace_id` parameter and implementing additional defense-in-depth measures.
