# GitHub import allows user to create child group under existing namespace

GitHub import endpoint created a subgroup under any existing namespace, giving attacker owner access to a subgroup of a private group they didn't belong to.

- Payout: $750
- Severity: high
- Program: GitLab
- Credited: jobert
- Disclosed: 2018-05-24
- CVE: CVE-2017-0919
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/301137
- Library page: https://bugbountylibrary.com/r/h1%3A301137
- Tags: domain:web impact:internal-access impact:privesc kind:bounty platform:hackerone sev:high tech:rest vuln:access-control vuln:auth-bypass vuln:idor

**Target:** GitHub import endpoint /import/github target_namespace parameter
**Root cause:** The import flow auto-creates the target namespace if it doesn't exist, without verifying the user has permission to create subgroups under the parent namespace.
**Steps:**
1. Sign in as a normal user and authorize GitLab to view GitHub projects.
2. Intercept the import request: `POST /import/github` with `repo_id=...&target_namespace=<user>&new_name=test`.
3. Change `target_namespace` to `secret-group/test` and submit.
4. Observe a subgroup `test` created under `secret-group` with the attacker as owner.
**How found:** Noticed the import request accepts an arbitrary target_namespace and that the code creates the namespace if missing; hypothesized no permission check on the parent namespace and tested with a private group path.
**Exploitation:** Attacker sets target_namespace to a victim group path plus a new subgroup name; the import creates the subgroup and grants owner, enabling use of the parent plan, member enumeration of a private group, and project creation under the unauthorized group.
**Escalation:** Owner of the subgroup can leverage the parent group's plan and create projects under a namespace they were never authorized for; could be abused to impersonate an org (e.g. gitlab-org) by setting a matching avatar.
**Insight:** On import/migration endpoints that accept a target namespace, test supplying a nested path under a group you don't belong to — auto-creation logic often skips parent-level authorization.