CVE-2020-13267: 
GitLab vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in GitLab CE/EE versions 12.8 through 13.0.1, identified as CVE-2020-13267. The vulnerability allowed the execution of Javascript payloads on the Metrics Dashboard (GitLab Release, NVD).

The vulnerability was caused by improper input validation in the metric dashboard duplication functionality. The modal to duplicate the dashboard failed to properly escape the default branch name, enabling stored XSS attacks. The vulnerability received a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

The stored XSS vulnerability could be triggered by any user with reporter access or above to the project. The exploit could be used to steal users' CSRF tokens and potentially lead to account takeover. The vulnerability was particularly severe as it could be executed on gitlab.com and had full impact for self-managed instances (HackerOne Report).

The vulnerability could be exploited by creating a specially crafted branch name containing malicious JavaScript code. When users accessed the Metrics Dashboard and attempted to duplicate it, the malicious code would execute in their browser context. The exploit was demonstrated to work on gitlab.com despite Content Security Policy (CSP) protections (HackerOne Report).

The vulnerability was patched in GitLab versions 13.0.1, 12.10.7, and 12.9.8. GitLab strongly recommended that all installations running affected versions be upgraded to the latest version immediately (GitLab Release).