CVE-2020-13350

Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the runner administration page of GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerability allows an attacker to perform state-changing actions (pause/resume runners) without proper CSRF token validation. Affected versions are >=13.5.0 before 13.5.2, >=13.4.0 before 13.4.5, and versions prior to 13.3.9 [1].

Exploitation

An attacker must trick a GitLab instance administrator into visiting a malicious page or clicking a crafted link while authenticated. The attacker can craft requests to endpoints such as /admin/runners/:runner_id/pause or /admin/runners/:runner_id/resume to pause or resume specific runners [1]. No additional privileges or authentication are required beyond the administrator's session.

Impact

Successful exploitation allows the attacker to pause or resume runners on the GitLab instance. This can disrupt CI/CD pipelines, potentially delaying or preventing software builds, tests, and deployments. The impact is limited to runner availability; no data disclosure or code execution is reported.

Mitigation

GitLab has released patches in versions 13.3.9, 13.4.5, and 13.5.2 [1]. Administrators should upgrade to one of these fixed versions or later. No workaround is available for unpatched versions. The vulnerability is not known to be exploited in the wild as of the publication date.