# Bypassing push rules via MRs created by Email

GitLab EE's email-to-merge-request feature applied patch attachments without enforcing project push rules, letting anyone push unsigned commits, secrets, and prohibited files.

- Payout: hidden
- Severity: medium
- Program: GitLab
- Found by: xanbanx
- Disclosed: 2019-10-01
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/526570
- Library page: https://bugbountylibrary.com/r/h1%3A526570
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:email technique:source-review vuln:access-control vuln:business-logic

**Target:** Email-in merge request ingestion endpoint
**Root cause:** The email-to-MR pipeline applies commits from a .patch attachment and pushes them without running the push-rule pre-check that normal git pushes go through.
**Steps:**
1. Create repo with Readme; create one dummy MR so the incoming email address is shown on the merge_requests page.
2. Read the incoming email address `incoming+<namespace>-<project>-<id>-<token>-request@incoming.example.gitlab.com` from the modal.
3. Configure push rules: committer restriction, reject unsigned commits, author is GitLab user, prevent secrets, commit message `Fixes \d+\..*`, negative match `ssh\:\/\`, author email `@example.com$`, prohibited filenames `(jar|exe)$`.
4. Locally create branch `bypass`, add `test.exe` and `id_dsa`, commit unsigned with message `Bypassing push rules ssh://foo.bar`.
5. Run `git format-patch -n HEAD^` and edit the `From` line to `Lin Jen <lin@yen.com>`.
6. Email the patch as attachment to the incoming address with subject `bypass` and body `MR bypassing the push rules`.
7. Observe the MR is created with all violating commits/files; only the branch-name rule is enforced.
**How found:** Noticed push rules are enforced by a pre-check on git push, then reasoned that the separate email-to-MR code path applies patches and likely skips that pre-check; tested by configuring all rules and emailing a violating patch.
**Exploitation:** Anyone who can obtain the project's incoming email address sends a crafted .patch attachment; GitLab applies the commits and opens an MR, bypassing every push rule except branch name.
**Insight:** When a product has multiple ingestion paths into the same repo (git push vs email patch vs API import), check whether policy checks like push rules are enforced on every path, not just the primary one.