CVE-2020-11506: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab versions 10.7.0 through 12.9.2, affecting both Community Edition (CE) and Enterprise Edition (EE). The vulnerability, identified as CVE-2020-11506, involves a Workhorse bypass that could lead to job artifact uploads and file disclosure through request smuggling. The vulnerability was disclosed and patched on April 14, 2020 (GitLab Advisory).

The vulnerability is classified as a request smuggling issue (CWE-444) that allows attackers to bypass GitLab Workhorse restrictions. The severity of this vulnerability is rated as HIGH with a CVSS v3.1 base score of 7.5 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The technical investigation revealed that a particular header could be used to override restrictions, resulting in GitLab Workhorse disclosing job artifact uploads and files in the /tmp directory (NVD, GitLab Advisory).

The vulnerability could lead to unauthorized disclosure of sensitive information through job artifact uploads and file exposure. The attack vector is network-accessible (AV:N) and requires no privileges or user interaction to exploit, making it particularly concerning for exposed GitLab instances (NVD).

The vulnerability requires low attack complexity (AC:L) and no authentication (PR:N) to exploit. The attack can be performed remotely without any user interaction (UI:N), making it relatively straightforward to exploit for potential attackers (NVD).

GitLab addressed this vulnerability in versions 12.9.3, 12.8.9, and 12.7.9 for both Community Edition and Enterprise Edition. The vendor strongly recommended that all installations running affected versions be upgraded to the latest version immediately. The fix was implemented to prevent the Workhorse bypass and restrict unauthorized file access (GitLab Advisory).

The vulnerability was responsibly reported by security researcher @manassehzhou, who was acknowledged in GitLab's security advisory. GitLab's security team conducted an internal investigation to verify and address the issue before releasing the patch (GitLab Advisory).