# Full access to internal Gitlab instances at redash.gitlab.com, dashboards.gitlab.com, prometheus.gitlab.com

Zendesk ticket-hash trick plus CC to noreply@google.com let attacker verify support@gitlab.com Google account, then log into internal GitLab instances via Google SSO.

- Payout: hidden
- Severity: critical
- Program: GitLab
- Found by: rijalrojan
- Disclosed: 2019-04-19
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/498964
- Library page: https://bugbountylibrary.com/r/h1%3A498964
- Tags: area:web domain:web impact:internal-access kind:bounty platform:hackerone sev:critical tech:email tech:sso technique:chained technique:recon vuln:access-control vuln:auth-bypass

**Target:** Zendesk support inbox and Google Workspace SSO on internal GitLab subdomains
**Root cause:** Zendesk exposes a per-ticket hash usable to append content to a ticket; combined with CC'ing noreply@google.com, the Google verification email became a public ticket comment, letting the attacker claim support@gitlab.com as a Google account.
**Steps:**
1. Send email to `support@gitlab.com`; receive auto-reply containing the Zendesk ticket hash.
2. Register `support@gitlab.com` at accounts.google.com, using the ticket hash as first and last name.
3. Google sends verification email; it lands as a private Zendesk comment since Google isn't CC'd.
4. Reply to the GitLab ticket with `noreply@google.com` in CC.
5. Re-trigger Google verification; the code now appears as a public ticket comment.
6. Complete verification, obtaining a verified `support@gitlab.com` Google account.
7. Enumerate gitlab.com subdomains via crt.sh; find prometheus, redash, dashboards.
8. Log into those internal instances via Google SSO using the verified account.
**How found:** Aware of Inti's prior Ticket Trick; noted GitLab blocked support+*@gitlab.com but realized Zendesk's per-ticket hash feature plus CC could still surface the Google verification email publicly.
**Exploitation:** Attacker gains a verified Google identity matching a GitLab-owned address, then authenticates via Google SSO to internal-only GitLab subdomains (prometheus, redash, dashboards), obtaining access to internal applications and dashboards.
**Escalation:** Single verified email pivots to multiple internal SSO-protected instances discovered via certificate transparency.
**Insight:** When a vendor blocks the known alias trick (support+*), check other Zendesk features: the per-ticket hash lets you inject content into a ticket, and CC'ing the verifier's no-reply address turns a private verification email into a public comment.