CVE-2020-13353 : Security Advisory and Response

A vulnerability in Gitaly affecting GitLab versions >=1.79.0 and <13.5.2 allows one-time use git credentials to persist longer than intended when importing repositories via URL.

Understanding CVE-2020-13353

This CVE involves the persistence of git credentials beyond the expected time window in Gitaly, impacting the security of GitLab instances.

What is CVE-2020-13353?

When importing repositories via URL, one-time use git credentials in Gitaly versions >=1.79.0 and <13.5.2 are retained longer than the specified time frame, posing a security risk.

The Impact of CVE-2020-13353

CVSS Base Score: 2.5 (Low)
Attack Complexity: High
Attack Vector: Local
Privileges Required: High
Scope: Changed
Confidentiality Impact: Low
Integrity Impact: None
User Interaction: None
Availability Impact: None

Technical Details of CVE-2020-13353

This section delves into the specifics of the vulnerability.

Vulnerability Description

The issue involves the improper handling of git credentials, leading to their persistence beyond the intended duration during repository imports.

Affected Systems and Versions

Product: Gitaly
Vendor: GitLab
Versions Affected:
=1.79.0, <13.3.9

=13.4, <13.4.5

=13.5, <13.5.2

Exploitation Mechanism

The vulnerability can be exploited by importing repositories via URL, causing the one-time use git credentials to remain active longer than expected.

Mitigation and Prevention

Protecting systems from CVE-2020-13353 requires immediate actions and long-term security measures.

Immediate Steps to Take

Update Gitaly to a patched version that addresses the credential persistence issue.
Monitor and revoke any unauthorized access that may have occurred due to this vulnerability.

Long-Term Security Practices

Implement regular security audits to identify and address similar issues proactively.
Educate users on secure credential management practices to prevent unauthorized access.

Patching and Updates

Apply the latest patches provided by GitLab to mitigate the vulnerability and prevent credential persistence issues.