id: gitlab-api-user-enum

info:
  name: GitLab - User Information Disclosure Via Open API
  author: Suman_Kar
  severity: medium
  reference:
    - https://gitlab.com/gitlab-org/gitlab-foss/-/issues/40158
  tags: gitlab,api,enum,user
  created: 2023/07/20

rules:
  r0:
    brute:
      mode: sniper
      commit: winner
      continue: false
      uid:
        - "1"
        - "2"
        - "3"
        - "4"
        - "5"
        - "6"
        - "7"
        - "8"
        - "9"
        - "10"
        - "2"
    request:
      method: GET
      path: /api/v4/users/{{uid}}
    expression: response.status == 200 && response.body.bcontains(b'"id":') && response.body.bcontains(b'"username":') && response.body.bcontains(b'"name":')
expression: r0()