CVE-2020-7966
📋 TL;DR
CVE-2020-7966 is a directory traversal vulnerability in GitLab Enterprise Edition that allows attackers to read arbitrary files on the server. This affects GitLab EE versions 11.11 through 12.7.2. Organizations running vulnerable GitLab instances are at risk of sensitive data exposure.
💻 Affected Systems
- GitLab Enterprise Edition
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive configuration files, source code, credentials, or other confidential data stored on the GitLab server, potentially leading to complete system compromise.
Likely Case
Unauthorized access to sensitive files containing API keys, database credentials, or proprietary source code, enabling further attacks or intellectual property theft.
If Mitigated
Limited impact with proper network segmentation, file system permissions, and monitoring in place to detect and block traversal attempts.
🎯 Exploit Status
Exploitation requires authentication as a GitLab user. Directory traversal techniques are well-understood and easy to implement once the vulnerability is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: GitLab EE 12.7.4 and later
Vendor Advisory: https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/
Restart Required: Yes
Instructions:
1. Backup your GitLab instance. 2. Update to GitLab EE 12.7.4 or later using your package manager. 3. For Omnibus: 'sudo apt-get update && sudo apt-get install gitlab-ee'. 4. Run 'sudo gitlab-ctl reconfigure'. 5. Verify the update with 'sudo gitlab-rake gitlab:env:info'.
🔧 Temporary Workarounds
Access Restriction
linuxRestrict GitLab access to trusted networks only using firewall rules
iptables -A INPUT -p tcp --dport 80,443 -s TRUSTED_NETWORK -j ACCEPT
iptables -A INPUT -p tcp --dport 80,443 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit GitLab access to authorized users only
- Enable detailed logging and monitoring for file access patterns and implement file integrity monitoring
🔍 How to Verify
Check if Vulnerable:
Check GitLab version: 'sudo gitlab-rake gitlab:env:info | grep Version'. If version is between 11.11 and 12.7.2 inclusive, you are vulnerable.Check Version:
sudo gitlab-rake gitlab:env:info | grep VersionVerify Fix Applied:
Confirm version is 12.7.4 or later: 'sudo gitlab-rake gitlab:env:info | grep Version'📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in GitLab logs
- Multiple failed attempts to access files outside expected directories
- Requests with '../' sequences in URLs
Network Indicators:
- HTTP requests containing directory traversal sequences like '../' or '..\'
- Unusual file downloads from GitLab server
SIEM Query:
source="gitlab.log" AND ("..\" OR "../" OR "%2e%2e%2f" OR "%2e%2e%5c")