CVE-2021-22205 : An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validati

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Published 2021-04-23 18:15:08

Updated 2022-07-12 17:42:04

Source GitLab Inc.

View at NVD, CVE.org

CVE-2021-22205 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

GitLab Community and Enterprise Editions Remote Code Execution Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.

Added on 2021-11-03 Action due date 2021-11-17

Exploit prediction scoring system (EPSS) score for CVE-2021-22205

Probability of exploitation activity in the next 30 days: 97.46%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2021-22205

GitLab Unauthenticated Remote ExifTool Command Injection

Disclosure Date: 2021-04-14

First seen: 2022-12-23

exploit/multi/http/gitlab_exif_rce

This module exploits an unauthenticated file upload and command injection vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The patched versions are 13.10.3, 13.9.6, and 13.8.8. Exploitation will result in command executio

More information

CVSS scores for CVE-2021-22205

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	3.9	6.0	GitLab Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High
10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	3.9	6.0	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2021-22205

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-22205

http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html

GitLab 13.10.2 Remote Code Execution ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url
https://gitlab.com/gitlab-org/gitlab/-/issues/327121

Not Found
Broken Link
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json

2021/CVE-2021-22205.json · master · GitLab.org / cves · GitLab
Vendor Advisory
https://hackerone.com/reports/1154542

Sign in
Permissions Required;Third Party Advisory

CVEs referencing this url
http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html

GitLab Unauthenticated Remote ExifTool Command Injection ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url

Products affected by CVE-2021-22205

Gitlab » Gitlab » Community Edition
Versions from including (>=) 11.9.0 and before (<) 13.8.8
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions
Gitlab » Gitlab » Community Edition
Versions from including (>=) 13.9.0 and before (<) 13.9.6
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 13.10.0 and before (<) 13.10.3
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Community Edition
Versions from including (>=) 13.10.0 and before (<) 13.10.3
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 13.9.0 and before (<) 13.9.6
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 11.9.0 and before (<) 13.8.8
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions

Vulnerability Details : CVE-2021-22205