k3ystr0k3r/cve-2021-22205CVE-2021-22205 - GitLab Unauthenticated Remote Code Execution
CVE-2021-22205 is a critical Remote Code Execution (RCE) vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerability originates from improper validation of uploaded image files that are processed by the third-party utility ExifTool. An attacker can craft a malicious file that triggers arbitrary command execution on the GitLab server. The vulnerability received a CVSS score of 10.0 (Critical) and has been observed being actively exploited in the wild.
The vulnerability affects GitLab CE/EE versions starting from 11.9 up to the following releases:
Organizations running vulnerable versions of GitLab were at risk of complete server compromise through a simple file upload attack.
GitLab uses ExifTool to extract and sanitize metadata from uploaded image files. ExifTool itself contained a vulnerability involving the processing of specially crafted DjVu files (tracked as CVE-2021-22204). GitLab incorrectly trusted file extensions and passed uploaded files to ExifTool without sufficient validation.
An attacker could disguise a malicious DjVu payload as an image file. When GitLab processed the file, ExifTool would interpret the malicious metadata and execute attacker-controlled commands on the server. The attack eventually became recognized as exploitable without authentication, significantly increasing its severity.
Successful exploitation may allow an attacker to:
Because many organizations expose GitLab instances directly to the internet, this vulnerability represented a severe supply-chain and infrastructure security risk.
Following public disclosure, security researchers and threat actors rapidly developed working exploits. Multiple reports documented widespread scanning and exploitation attempts against publicly accessible GitLab instances. The vulnerability was later added to CISA's Known Exploited Vulnerabilities (KEV) catalog.
Administrators should immediately upgrade to one of the patched releases:
Additional recommendations include:
GitLab officially urged self-managed customers to update as soon as possible after exploitation activity was observed.
This repository is intended solely for educational purposes, security research, and authorized testing environments. Any proof-of-concept (PoC) code provided is designed to help security professionals understand the vulnerability and verify remediation efforts. Unauthorized testing against systems you do not own or have explicit permission to assess may violate applicable laws and regulations.
