3 ms·
It would depend on the rules for the program. GitLab's HackerOne Rules of Engagement do not explicitly prohibit testing on gitlab.com except for attacks that ar
by bink 4y ago
It would depend on the rules for the program. GitLab's HackerOne Rules of Engagement do not explicitly prohibit testing on gitlab.com except for attacks that are "disruptive" or access the private information of other users.
I'd personally put running an RCE into that category, but it's subjective.
https://hackerone.com/gitlab?type=team https://hackerone.com/gitlab?type=team
- thayne 4y ago> I'd personally put running an RCE into that category, but it's subjective. I think that would depend on what code is being run. If it is something innocuous that just reports back that it was run, without any data, that doesn't seem disruptive or like it would access private information.
- nigma1337 4y agoIt does also seem like the reporter was extremely careful as to not accidentally access user data > After seeing the pings, I immediately turned off the replication by executing the redis command REPLICAOF no one\n\n. No information from your redis server has been replicated to mine as I used nc and I got only the ping messages.
- whimsicalism 4y agoI mean they caused an internal server error on the Gitlab end. I agree they definitely weren't trying to access any user data other than their own.