Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2021-22205 — CVE-2021-22205 exploit script | Kitploit
Tools/GitHubGitHub/cc3305/cve-2021-22205
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed Teaming
GitHubcc3305/cve-2021-22205

CVE-2021-22205

CVE-2021-22205 exploit script

View Repository
2 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2021-22205

Preauth RCE via exiftool on Gitlab CE/EE

Summary of the CVE

GitLab uses ExifTool to scan every tiff/jpeg/jpg file to remove any tags that are not whitelisted. But because ExifTool doesn't use file extensions to determine filetype but it rather uses the content of the file, which allows an attacker to upload any file, rename it to tiff/jpeg/jpg and "abuse" any of the ExifTool supported parsers. When parsing DjVu files ExifTool evals DjVu annotation tokens to convert C escape sequences.

Affected Versions

  • Gitlab CE/EE >= 11.9 < 13.8.8
  • Gitlab CE/EE >= 13.9 < 13.9.6
  • Gitlab CE/EE >= 13.10 < 13.8.8

Anomalies

Uploads a image file to the server.

References

  • Original Report - vakzz, Apr 07 2021
  • Github POC - Al1ex, Oct 29 2021
  • CVE-details - CVSS Score 10.0
Download Tool