CVE-2020-13262: 
GitLab vulnerability analysis and mitigation

Client-Side code injection vulnerability (CVE-2020-13262) was discovered in GitLab CE/EE versions 12.9 and later through 13.0.1. The vulnerability allows attackers to execute specially crafted Mermaid markup payloads that can perform PUT requests on behalf of other users when they click on a malicious link (GitLab Release, NVD).

The vulnerability exists in the Mermaid markup functionality where users can set class names of blocks. The issue stems from the way issue.js handles click events on certain elements. When a user clicks on a specially crafted link, the system executes PUT requests to attacker-controlled destinations. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

An attacker could potentially perform arbitrary PUT requests on behalf of other users who click on malicious links. This could lead to unauthorized modifications of data, as the requests would be executed with the privileges of the clicking user (GitLab Release).

The vulnerability requires user interaction to be exploited. An attacker needs to create a specially crafted Mermaid payload in an issue description, and the target user must click on the malicious link for the exploit to work. The vulnerability has been confirmed to be exploitable on GitLab.com (GitLab Issue).

GitLab has addressed this vulnerability in versions 13.0.1, 12.10.7, and 12.9.8. Users are strongly recommended to upgrade to one of these patched versions immediately to mitigate the risk (GitLab Release).