# Arbitrary file read during project import

Malicious GitLab export tarball abuses json schema validator's open-uri to read arbitrary server files, leaking DB credentials via the import API.

- Payout: $16,000
- Severity: critical
- Program: GitLab
- Found by: saltyyolk
- Disclosed: 2021-05-24
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1132378
- Library page: https://bugbountylibrary.com/r/h1%3A1132378
- Tags: area:web domain:web impact:data-leak impact:privesc kind:bounty platform:hackerone sev:critical tech:ruby technique:source-review vuln:info-disclosure vuln:path-traversal vuln:ssrf

**Target:** GitLab project import (GitLab export tarball) and /api/v4/projects/:id/import endpoint
**Root cause:** Mis-usage of a json schema validator that resolves remote/local references via open-uri, letting attacker-controlled import data trigger file reads (and SSRF).
**Steps:**
1. Craft `import.tar.gz` GitLab export containing a json schema reference that the validator resolves via open-uri to a local file path.
2. Import it on gitlab.com via the import feature as 'GitLab export'.
3. Wait for the import process to finish.
4. Request `https://gitlab.com/api/v4/projects/PROJECT_ID/import` (PROJECT_ID from project home page).
5. Read ~250 bytes of the target file reflected in the import status output.
**How found:** Researcher noted the import flow uses a json schema validator whose reference resolution relies on open-uri, making it both a file-read and SSRF primitive; then mapped which credential files sit on the sidekiq/rails hosts via the GitLab helm charts.
**Exploitation:** Attacker uploads a crafted GitLab export; the import pipeline's json schema validation dereferences an attacker-controlled reference through open-uri, reading a local file. The first ~250 bytes are surfaced in the project import status API response, leaking credentials such as Rails secret_key_base, database and SMTP credentials on GitLab.com.
**Escalation:** On self-hosted instances, reading `.gitlab_shell_token` enables calls to internal APIs like `/api/v4/internal/personal_access_token`, minting a personal access token for another user including an admin.
**Insight:** Import/export pipelines that validate attacker-supplied JSON schemas are a file-read/SSRF surface: check whether the validator resolves $ref/remote references via open-uri, and whether partial file contents are reflected in async job status endpoints.