OS Command Injection in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2021-22205
Published: April 22, 2021 / Updated: May 23, 2024
Vulnerability identifier: #VU52499
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-22205
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote user to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation within image parser when processing image files. A remote authenticated user can upload a specially crafted image file to the system and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Arch Linux
Gitlab Community Edition
Arch Linux
How to mitigate CVE-2021-22205
Install updates from vendor's website.
GitLab Enterprise Edition - addressed in versions 13.8.8, 13.9.6, 13.10.3
Gitlab Community Edition - addressed in versions 13.8.8, 13.9.6, 13.10.3
Gitlab Community Edition - addressed in versions 13.8.8, 13.9.6, 13.10.3
Links to Public Exploits and PoC-codes
- Exploit #9830 - CVE-2021-22205 (CVE-2021-22205 exploit script) (May 23, 2024)
- Exploit #8160 - CVE-2021-22205 (CVE-2021-22205 检测脚本,支持getshell和命令执行) (July 21, 2022)
- Exploit #7324 - GitLab-cve-2021-22205-nse (NSE script to fingerprint if GitLab is vulnerable to cve-2021-22205-nse) (February 6, 2022)
- Exploit #7174 - CVE-2021-22205 (Pocsuite3 For CVE-2021-22205) (December 15, 2021)
- Exploit #7094 - Golang-CVE-2021-22205-POC (A CVE-2021-22205 Gitlab RCE POC written in Golang) (November 29, 2021)
- Exploit #7040 - GitLab 13.10.2 - Remote Code Execution (RCE) (Unauthenticated) (November 25, 2021)
- Exploit #7005 - CVE-2021-22205 (GitLab CE/EE Preauth RCE using ExifTool) (November 11, 2021)
- Exploit #7002 - GitLab-CVE-2021-22205-scanner () (November 11, 2021)
- Exploit #6995 - Automated-Gitlab-RCE (Automated Gitlab RCE via CVE-2021-22205) (November 8, 2021)
- Exploit #6992 - GitLab-CVE-2021-22205- (Exploit for GitLab CVE-2021-22205 Unauthenticated Remote Code Execution) (November 8, 2021)
- Exploit #6990 - Gitlab_RCE_CVE_2021_2205 () (November 4, 2021)
- Exploit #6989 - CVE-2021-22205 (CVE-2021-22205& GitLab CE/EE RCE) (November 4, 2021)
- Exploit #6978 - GitLab Unauthenticated Remote ExifTool Command Injection (November 3, 2021)
- Exploit #6976 - Gitlab_RCE_CVE_2021_22205 () (November 2, 2021)
- Exploit #6971 - CVE-2021-22205 (personal) (November 1, 2021)
- Exploit #6970 - CVE-2021-22205 () (November 1, 2021)
- Exploit #6969 - CVE-2021-22205-getshell (CVE-2021-22205-getshell) (November 1, 2021)
- Exploit #6966 - CVE-2021-22205 (CVE-2021-22205 Gitlab 未授权远程代码执行漏洞 EXP, 移除了对djvumake & djvulibre的依赖，可在win平台使用) (November 1, 2021)
- Exploit #6965 - CVE-2021-22205 (Gitlab CE/EE RCE 未授权远程代码执行漏洞 POC && EXP CVE-2021-22205) (November 1, 2021)
- Exploit #6963 - CVE-2021-22205 (CVE-2021-22205 RCE ) (November 1, 2021)
- Exploit #6962 - GitLab-preauth-RCE_CVE-2021-22205 (PoC in single line bash) (November 1, 2021)
- Exploit #6961 - CVE-2021-22205 (CVE-2021-22205未授权漏洞批量检测与利用工具) (November 1, 2021)
- Exploit #6956 - CVE-2021-22205 (Pocsuite3 For CVE-2021-22205) (October 29, 2021)
- Exploit #6954 - CVE-2021-22205 (CVE-2021-22205 Unauthorized RCE) (October 29, 2021)
- Exploit #5535 - Gitlab-CVE-2021-22205 () (June 6, 2021)