← Back to context

Comment by dvdkon

2 hours ago

As far as I can tell, it requires forcing GitLab to render a malicious org-mode file. I don't really see a way to do that without authenticating and uploading one. Am I missing something?

1 comment

dvdkon

Reply
merb  1 hour ago 

    The attack needs no authentication — only one public project that can hold the .org payload.

So probably not vulnerable if no public projects exist - ie self hosted has an needs auth for everything mode.