CVE-2020-13293: 
GitLab vulnerability analysis and mitigation

In GitLab before versions 13.0.12, 13.1.6, and 13.2.3, a vulnerability was discovered where using a branch with a hexadecimal name could override an existing hash. This vulnerability was assigned CVE-2020-13293 and was disclosed on August 5, 2020 (GitLab Release, NVD).

The vulnerability allows an attacker to create a branch with the same name as a git hash, causing git to prefer the branch name over the hash when checking out code. This could lead to unexpected behavior when specific commit hashes are referenced in programs or scripts. The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (HIGH) and a CVSS v2.0 base score of 5.5 (MEDIUM) (NVD).

When exploited, this vulnerability could allow an attacker to redirect pinned references of libraries to malicious code. If someone references a specific commit hash in their program, the attacker could create a branch with that hash name containing different, potentially malicious code. This could lead to the introduction of backdoors, data theft, or other malicious activities in dependent applications (GitLab Issue).

The vulnerability can be exploited by creating a branch with a name matching a 40-character hexadecimal git hash. When users or systems attempt to checkout the specific commit hash, git will instead checkout the branch with the matching name, potentially executing unintended code (GitLab Issue).

The vulnerability has been fixed in GitLab versions 13.0.12, 13.1.6, and 13.2.3. Users are strongly recommended to upgrade to these versions or later to prevent potential exploitation (GitLab Release).

The vulnerability was responsibly reported by security researcher @retroplasma through the GitLab bug bounty program (GitLab Release).