CVE-2020-13322: 
GitLab vulnerability analysis and mitigation

A vulnerability (CVE-2020-13322) was discovered in GitLab versions after 12.9, affecting the authorization checks for deploy tokens. The vulnerability was reported by security researcher Ashish R Padelkar and was addressed in GitLab's security release versions 13.1.2, 13.0.8, and 12.10.13 released on July 1, 2020 (GitLab Release, CVE Mitre).

The vulnerability stemmed from improper verification of permissions in GitLab's deploy token functionality. Specifically, the issue allowed project members with Maintainer role to create and delete deploy tokens, which should have been restricted to group owners only. The vulnerability was particularly exploitable through GitLab's API endpoints for deploy token management (GitLab Issue).

The vulnerability allowed unauthorized users to create and delete deploy tokens at the group level, bypassing intended access control restrictions. This could potentially lead to unauthorized access to repositories and resources that should have been protected by proper deploy token management controls (GitLab Release).

The vulnerability could be exploited by making API calls to the deploy token endpoints. A group maintainer could create tokens by sending POST requests to the API endpoint with specific parameters including token name, expiration date, username, and scopes. Similarly, deletion of tokens could be performed through DELETE requests to the API endpoint (GitLab Issue).

GitLab addressed this vulnerability in versions 13.1.2, 13.0.8, and 12.10.13. Organizations running affected versions of GitLab (12.9 and later) were strongly recommended to upgrade to these patched versions immediately to mitigate the security risk (GitLab Release).