# Stored XSS in main page of a project caused by arbitrary script payload in group "Default initial branch name"

Unsanitized group 'default initial branch name' is reflected into a new project's setup page, giving stored XSS that can steal tokens or hijack links.

- Payout: hidden
- Severity: high
- Program: GitLab
- Found by: joaxcar
- Disclosed: 2021-09-15
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1256777
- Library page: https://bugbountylibrary.com/r/h1%3A1256777
- Tags: area:web domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:high tech:ruby technique:chained vuln:xss

**Target:** Group repository settings / project setup page
**Root cause:** The group 'Default initial branch name' setting accepts arbitrary text and is inserted unescaped into the example terminal commands on a new project's main page.
**Steps:**
1. Create users attacker01 and victim01
2. As attacker01 create group attack_group
3. Go to /groups/attack_group/-/settings/repository, expand 'Default initial branch name'
4. Set value to `<script>alert(1);</script>` and save
5. Create a blank project attacking_project in the group
6. Project main page loads and alert fires
7. Optionally invite victim01 as Developer; victim visiting project URL triggers payload
**How found:** Noticed the branch name setting accepts arbitrary text and is echoed into example setup commands on a new project page, then tested a script payload.
**Exploitation:** Attacker sets a script payload as the group default branch name, creates a project, and invites victims as Developers; when victims click the notification/email link to the project page the script runs. On self-hosted instances without CSP the script can generate personal access tokens for the victim, yielding full account access (instance takeover if admin). On GitLab.com CSP blocks script but `<Base Href>` payload redirects all page links to attacker site.
**Escalation:** Inviting targeted users as Developers turns notification emails into validated phishing links; token theft escalates to account/instance takeover when victim is admin.
**Insight:** Group-level settings that get templated into per-project onboarding/example command snippets are a stored-XSS surface; test settings like default branch names, and note that even with CSP, base-uri injection can hijack all links.