CVE-2020-13356: 
GitLab vulnerability analysis and mitigation

A file disclosure vulnerability (CVE-2020-13356) was discovered in GitLab CE/EE affecting all versions from 8.8.9 to 13.5.2. The vulnerability allows an attacker to bypass Multipart protection and read files in specific paths on the server through a specially crafted request (GitLab Security Release, Debian Tracker).

The vulnerability stems from insufficient validation in the Multipart protection mechanism. An attacker could exploit this by crafting specific requests that bypass the protection controls, particularly when handling file upload parameters within a hash structure, such as user[avatar]. The issue affects GitLab installations with Object Storage enabled and allows access to certain specific paths on the server (GitLab Issue).

When successfully exploited, this vulnerability allows unauthorized access to read files in specific paths on the server. This could potentially lead to information disclosure of sensitive data stored in the affected paths, particularly impacting GitLab installations that use Object Storage (GitLab Security Release).

The vulnerability was discovered and reported through GitLab's HackerOne bug bounty program by researcher ledz1996. The exploit requires the ability to send specially crafted requests to the affected GitLab instance (GitLab Security Release).

GitLab has addressed this vulnerability in versions 13.5.2, 13.4.5, and 13.3.9. It is strongly recommended that all installations running affected versions be upgraded to one of these patched versions immediately (GitLab Security Release).