CVE-2020-13311: 
GitLab vulnerability analysis and mitigation

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4 where the Wiki functionality was susceptible to a parser attack. The vulnerability, identified as CVE-2020-13311, was discovered through an internal investigation and affected all GitLab versions prior to 13.0. The issue was publicly disclosed and patched in September 2020 (GitLab Release).

The vulnerability stemmed from improper handling of the tilde (~) character in wiki page paths. When a wiki page was created with a title containing a tilde, the system would incorrectly expand it to the GitLab user's home directory (/var/opt/gitlab), leading to path handling issues. This parser vulnerability affected the Wiki's functionality through the user interface (GitLab Issue).

The vulnerability resulted in a Denial of Service (DoS) condition specifically targeting the Wiki functionality. When exploited, it prevented users from accessing the Wiki through the user interface. Additionally, affected pages could neither be modified nor deleted through the web interface, effectively making them unmanageable (GitLab Issue).

The vulnerability could be triggered by creating a wiki page with a title containing a tilde character (~). The exploitation process was relatively straightforward and could be executed through the standard web interface, requiring only normal user access to the Wiki functionality (GitLab Issue).

The vulnerability was addressed in GitLab versions 13.1.10, 13.2.8, and 13.3.4. GitLab strongly recommended that all installations running affected versions be upgraded to the latest version immediately. The fix prevented the incorrect expansion of the tilde character in wiki page paths (GitLab Release).