# GitLab's GitHub integration is vulnerable to SSRF vulnerability

GitLab's GitHub integration followed attacker-controlled 302 redirects, letting any user SSRF arbitrary POST requests into the internal network and cloud metadata APIs.

- Payout: $2,000
- Severity: medium
- Program: GitLab
- Credited: jobert
- Disclosed: 2019-08-30
- CVE: CVE-2019-5461
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/446593
- Library page: https://bugbountylibrary.com/r/h1%3A446593
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:medium tech:ruby technique:recon vuln:open-redirect vuln:ssrf

**Target:** GitLab GitHub integration commit-status request
**Root cause:** Octokit HTTP client followed attacker-controlled 302 redirects from the configured external repository URL without restricting the redirect destination.
**Steps:**
1. Sign in as any user and create a new project.
2. Add a `.gitlab-ci.yml` so a pipeline exists (creates a commit status to report).
3. Configure the GitHub integration with an external repo URL under attacker control, e.g. `http://remote_ip/1/2`.
4. Click `Test settings and save changes`; GitLab sends `POST /api/v3/repos/1/2/statuses/<sha>` to the attacker host.
5. Respond `HTTP/1.1 302 Found` with `Location: http://127.0.0.1/` (or `:8080`, `:22`).
6. Observe the internal host's response reflected in the UI error message.
**How found:** Recognized that the GitHub integration makes outbound requests to a user-supplied repository URL, then tested whether the HTTP client honored redirects by returning a 302 to an internal address and observing the reflected response.
**Exploitation:** Attacker hosts a fake GitHub API endpoint, receives the commit-status POST, and replies with a 302 redirect to an internal address. The Octokit client follows the redirect and issues the POST to the internal target; the response body is surfaced in the GitLab UI error, giving read-back. Redirecting to cloud metadata APIs (e.g. 169.254.169.254) could yield credentials leading to command execution.
**Escalation:** Chaining the SSRF to cloud instance metadata API to obtain credentials and potentially execute commands on the machine.
**Insight:** When an integration lets you set a remote base URL, test whether its HTTP client follows redirects — a 302 Location to internal/metadata addresses turns a benign webhook into SSRF, and error messages often reflect the internal response for read-back.