# Exfiltrate and mutate repository and project data through injected templated service

GitLab project import trusted a user-supplied `template:true` flag on services, letting any user install instance-wide service templates that exfiltrate other projects' data.

- Payout: $11,000
- Severity: critical
- Program: GitLab
- Credited: jobert
- Disclosed: 2019-03-05
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/446585
- Library page: https://bugbountylibrary.com/r/h1%3A446585
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:critical tech:ruby technique:source-review vuln:access-control vuln:idor vuln:info-disclosure vuln:misconfiguration

**Target:** Project import / service templates (Projects::CreateService)
**Root cause:** Project import deserialized the `services` array from project.json without stripping the `template` attribute, so a non-admin could persist a service as an instance-wide template that Projects::CreateService then auto-installs on every newly created project.
**Steps:**
1. Create project, enable CI service under Settings > Integrations
2. Export project and download export archive
3. Extract; edit `project.json` services array: set `"template":true` and change `type` to `MockCiService` (or `EmailsOnPushService`/`HipchatService`)
4. Repack: `tar -zcvf service_template.tar.gz project.json VERSION project.bundle`
5. Import the tar as any user
6. As another user, create a new project and immediately export it
7. Observe the injected service present in the new project's project.json
**How found:** Code reading of Projects::CreateService#create_services_from_active_templates revealed services are built from any `Service.where(template:true)`; then inspecting the export format showed the `template` attribute is serialized and re-imported verbatim, prompting the tamper test.
**Exploitation:** Attacker imports a crafted export whose service has `template:true`; the service is saved as an instance-wide template. Every subsequently created project auto-instantiates it. Using EmailsOnPushService with attacker recipient, commit diffs are emailed out; using HipchatService, all issues/MRs/pipelines/pushes are forwarded to attacker server; MockCiService gives a hidden exfil endpoint not shown in UI.
**Escalation:** Single injected template affects all future projects instance-wide, turning a per-project import into cross-tenant data exfiltration; ExternalWikiService/CustomIssueTrackerService can overwrite issue/wiki URLs for social engineering.
**Insight:** When a feature imports serialized model attributes, check whether privileged flags (template, admin, owner) survive round-trip; a per-object import can become an instance-wide template if creation code queries by that flag.