# Internal Gitlab Ticket Disclosure via External Slack Channels

Slack link previews of internal GitLab issues leaked ticket titles/descriptions and Sentry exception contents to external pentesters via sequential issue IDs.

- Payout: hidden
- Severity: high
- Program: HackerOne
- Found by: none_of_the_above
- Disclosed: 2021-08-04
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1273292
- Library page: https://bugbountylibrary.com/r/h1%3A1273292
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high tech:rest technique:recon vuln:info-disclosure

**Target:** Slack channel link unfurling of internal GitLab issues and Sentry exceptions
**Root cause:** Slack's link-preview unfurler fetched internal GitLab/Sentry URLs with access that external Slack workspace members lacked, exposing content of internal-only resources.
**Steps:**
1. Post an internal GitLab issue URL in the shared Slack channel
2. Observe Slack auto-generates a preview containing the ticket title/description
3. Iterate sequential GitLab issue IDs to enumerate other internal tickets
4. Same misconfiguration exposed Sentry exception contents from production
**How found:** Researcher noticed a pasted internal GitLab link auto-expanded into a preview visible to an external pentester, then hypothesized sequential IDs would allow enumeration.
**Exploitation:** A pentester replied in Slack with an internal GitLab link; Slack unfurled it, revealing the internal ticket preview to non-employees. Iterating sequential IDs enumerated titles/descriptions of arbitrary internal issues.
**Escalation:** Sequential ID iteration scaled disclosure from one ticket to all internal GitLab issues; investigation found Sentry exceptions also reachable.
**Insight:** Chat-platform link unfurlers fetch URLs server-side with broader privileges than the poster; test internal-only URLs pasted into shared/external Slack or Teams channels for preview leakage, and check sequential-ID resources for enumeration.