CVE-2020-11505: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before versions 12.7.9, 12.8.9, and 12.9.3. The vulnerability, identified as CVE-2020-11505, involved a Workhorse bypass that could lead to NuGet package and file disclosure, resulting in potential exposure of sensitive information through request smuggling. The vulnerability was discovered and disclosed in April 2020 (GitLab Release, CVE Mitre).

The vulnerability stemmed from a specific header that could be exploited to override restrictions in GitLab Workhorse, leading to unauthorized disclosure of NuGet packages and files stored in the /tmp directory. The issue affected GitLab EE versions 12.8.0 and later (GitLab Release).

The vulnerability could result in unauthorized access to sensitive information through the exposure of NuGet packages and files stored in the temporary directory, potentially compromising system security (GitLab Release).

The vulnerability was discovered through an internal investigation and was also responsibly reported by security researcher @vakzz. No public exploits were reported in the wild before the patch release (GitLab Release).

GitLab addressed this vulnerability by releasing patches in versions 12.7.9, 12.8.9, and 12.9.3. Organizations running affected versions were strongly recommended to upgrade to these patched versions immediately to mitigate the risk (GitLab Release).