CVE-2020-13283
📋 TL;DR
This cross-site scripting (XSS) vulnerability in GitLab allows attackers to inject malicious scripts into milestone titles, which then execute in victims' browsers when viewing the issues list. It affects all GitLab instances running vulnerable versions, potentially compromising user sessions and data.
💻 Affected Systems
- GitLab Community Edition
- GitLab Enterprise Edition
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on user systems.
Likely Case
Session hijacking leading to unauthorized access to repositories, issues, and sensitive project data.
If Mitigated
Limited impact with proper content security policies and user awareness, though XSS could still bypass some controls.
🎯 Exploit Status
Exploitation requires creating or modifying milestones with malicious titles, which typically requires at least reporter-level permissions. Public proof-of-concept exists in HackerOne report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: GitLab 13.0.12, 13.1.6, or 13.2.3 and later
Vendor Advisory: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13283.json
Restart Required: Yes
Instructions:
1. Backup your GitLab instance. 2. Update to GitLab 13.0.12, 13.1.6, or 13.2.3 or newer. 3. For Omnibus installations: 'sudo gitlab-ctl reconfigure'. 4. For source installations: follow GitLab upgrade documentation. 5. Verify the update completed successfully.
🔧 Temporary Workarounds
Input Sanitization Enhancement
allImplement additional input validation and output encoding for milestone titles
Not applicable - requires code changes
Content Security Policy
linuxImplement strict CSP headers to mitigate XSS impact
Add to nginx config: add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';" always;
🧯 If You Can't Patch
- Restrict milestone creation/modification permissions to trusted users only
- Implement web application firewall (WAF) rules to detect and block XSS payloads in milestone titles
🔍 How to Verify
Check if Vulnerable:
Check GitLab version: if running version before 13.0.12, 13.1.6, or 13.2.3, you are vulnerable.Check Version:
For Omnibus: 'sudo gitlab-rake gitlab:env:info | grep Version'. For source: check VERSION file in installation directory.Verify Fix Applied:
After patching, verify version is 13.0.12, 13.1.6, 13.2.3 or newer and test milestone title input sanitization.📡 Detection & Monitoring
Log Indicators:
- Unusual milestone creation/modification patterns
- Suspicious characters in milestone titles (script tags, javascript: URIs)
- Multiple failed XSS attempts in web logs
Network Indicators:
- HTTP requests with XSS payloads in milestone parameters
- Unexpected external resource loading from milestone pages
SIEM Query:
source="gitlab.logs" AND ("milestone" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload="))🔗 References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13283.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/218448
- https://hackerone.com/reports/877065
- https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13283.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/218448
- https://hackerone.com/reports/877065
