CRLF injection in Gitlab Community Edition - CVE-2018-19585
Published: May 17, 2019 / Updated: June 17, 2021
Vulnerability identifier: #VU31064
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-19585
CWE-ID: CWE-93
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to manipulate data.
GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol.
Affected software
Gitlab Community Edition
How to mitigate CVE-2018-19585
Install update from vendor's website.
Gitlab Community Edition - update to 11.5.1
Links to Public Exploits and PoC-codes
- Exploit #5623 - GitLab 11.4.7 - RCE (Authenticated) (June 17, 2021)
- Exploit #5628 - GitLab 11.4.7 - Remote Code Execution (Authenticated) (June 17, 2021)
- Exploit #5280 - gitlab-RCE-11.4.7 (GitLab 11.4.7 RCE exploit with different reverse shells. CVE-2018-19571 + CVE-2018-19585) (April 12, 2021)
- Exploit #5132 - edb-49263-fixed (Fixed version of the Python script to exploit CVE-2018-19571 and CVE-2018-19585 (GitLab 11.4.7 - Authenticated Remote Code Execution) that is available at https://www.exploit-db.com/exploits/49263 (Python 3.9).) (February 9, 2021)
- Exploit #4935 - gitlab_RCE (RCE for old gitlab version <= 11.4.7 & 12.4.0-12.8.1 and LFI for old gitlab versions 10.4 - 12.8.1) (December 16, 2020)
- Exploit #4932 - gitlab_RCE (RCE for old gitlab version <= 11.4.7) (December 16, 2020)