4 ms·
The way the report was written, I suspect this was another open Gitlab server. Most people who self-host Gitlab doesn't realize that between the default self-r
by rshnotsecure 6y ago
The way the report was written, I suspect this was another open Gitlab server.
Most people who self-host Gitlab doesn't realize that between the default self-registration and "Explore" button at the bottom, possible for entirely random individuals to gain enormous access.
I have written the Naval Postgraduate School several times since December about their open Gitlab server (maybe it is supposed to be open though) which seems exposed via the "Explore" tab at the bottom: https://204.102.228.54/users/sign_in https://204.102.228.54/users/sign_in
- hahajk 6y agoProbably not supposed to be open. Although technically anything developed by the govt is public domain...
- hlieberman 6y agoPlease send me an email at harlan -at- dds.mil or file a report on https://hackerone.com/deptofdefense https://hackerone.com/deptofdefense and we'll get it closed.
- bobmaxup 6y agobrowsing through it, there are some references in readme files to cloning repos without an account, so I think that the users are aware.
- dan_hawkins 6y agoCert reveals DN: https://gitlab.nps.edu/users/sign_in https://gitlab.nps.edu/users/sign_in