CVE-2020-13329: 
GitLab vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in GitLab's blob viewer feature, identified as CVE-2020-13329. The vulnerability affected GitLab versions from 12.6.2 prior to 12.10.13, and was disclosed and patched in July 2020. The security researcher @yvvdwf responsibly reported this vulnerability to GitLab (GitLab Release, CVE Mitre).

The vulnerability was discovered in GitLab's blob viewer feature when viewing JSON files, particularly OpenAPI files. When the openapi_viewer was called to transfer file data to SwaggerUIBundle for rendering, it allowed HTML tags and attributes in the OpenAPI description. Although malicious tags and attributes were removed, the filtering was insufficient as class and style attributes could still be manipulated by attackers. The vulnerability received a CVSS v3.1 score of 5.4 (MEDIUM) (NVD Results).

The vulnerability allowed attackers to create a transparent layer that could intercept user clicks and execute arbitrary actions. Through data-* attributes and jquery-ujs, attackers could craft requests to the server (including PUT, DELETE, and HEAD methods) with arbitrary parameters. The existing Content Security Policy (CSP) could be bypassed using jQuery.globalEval, enabling stored XSS attacks that could perform any action on behalf of users at the client side (GitLab Issue).

The vulnerability could be exploited by creating a specially crafted JSON file with malicious content in the OpenAPI description field. When users viewed this file through GitLab's blob viewer, the XSS payload would execute. The proof of concept demonstrated that clicking anywhere on the document view would trigger the malicious code (GitLab Issue).

GitLab addressed this vulnerability in versions 13.1.2, 13.0.8, and 12.10.13, released on July 1, 2020. The company strongly recommended that all affected installations be upgraded to one of these versions immediately. The fix involved implementing proper checks on the content generated by SwaggerUIBundle and removing inappropriate HTML attributes such as data-*, style, and class (GitLab Release).