CVE-2020-13295: 
GitLab Runner vulnerability analysis and mitigation

GitLab Runner versions before 13.0.12, 13.1.6, and 13.2.3 contained a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability was discovered and disclosed in August 2020, affecting all previous versions of GitLab Runner. The issue allowed an attacker to perform SSRF attacks by replacing the Docker daemon with a malicious server in the Shared Runner environment (GitLab Release, NVD).

The vulnerability stems from a bug in the Docker client implementation within Shared Runners that allowed following HTTP redirections. The Docker daemon running in executors, which are under user control, could be replaced with a malicious HTTPS server that sends redirect responses. TLS validation could not prevent this attack since both public and private keys used by the Docker daemon in the executor were under the CI job's control. The vulnerability received a CVSS v3.1 base score of 8.8 (HIGH) from NVD and 5.4 (MEDIUM) from GitLab Inc (NVD).

The vulnerability allowed attackers to perform blind SSRF attacks targeting the Shared Runner's localhost, link-local, and local networks. In error cases, the response body would be displayed in CI job logs. Successful HTTP requests could reveal the first character of the response or cause process hanging if the response was valid JSON. The attack could potentially be used to access sensitive metadata services and perform resource exhaustion attacks (GitLab Release).

The vulnerability could be exploited by obtaining a reverse shell into the Executor, gaining root access to the Executor, mounting the host file system, and setting up a malicious HTTPS server. The attacker could then redirect the Runner's Docker Client's requests to target internal services. The exploit required multiple steps but could be automated (GitLab Release).

The vulnerability was patched in GitLab Runner versions 13.0.12, 13.1.6, and 13.2.3. Organizations were strongly recommended to upgrade their GitLab Runner installations to these versions immediately. The fix prevented the Runner's Docker client from trusting the Docker daemon and following redirections from the Docker REST API, particularly to local addresses (GitLab Release).

The vulnerability was responsibly reported by security researcher @lucash-dev through the HackerOne platform. GitLab addressed the issue promptly and included it in their scheduled security release along with several other security fixes (GitLab Release).