https://github.com/mr-r3bot/Gitlab-CVE-2021-22205

https://github.com/mr-r3bot/Gitlab-CVE-2021-22205

Last synced: about 2 months ago
JSON representation

• Host: GitHub
• URL: https://github.com/mr-r3bot/Gitlab-CVE-2021-22205
• Owner: mr-r3bot
• Created: 2021-06-05T15:42:16.000Z (over 3 years ago)
• Default Branch: main
• Last Pushed: 2021-11-02T14:45:24.000Z (about 3 years ago)
• Last Synced: 2024-06-06T20:57:45.350Z (8 months ago)
• Language: Python
• Size: 20.5 KB
• Stars: 184
• Watchers: 3
• Forks: 44
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-hacking-lists - mr-r3bot/Gitlab-CVE-2021-22205 - (Python)

README

        
## Unauthenticated RCE on Gitlab version < 13.10.3

Unauthenticated RCE exploit for gitlab version < 13.10.3

**For educational/research purpose only. Use at your own risk**

Root cause:

- When uploading image files, Gitlab Workhorse passes any files with the extensions jpg|jpeg|tiff through to ExifTool to remove any non-whitelisted tags.

- One of the supported formats is DjVu. When parsing the DjVu annotation, the tokens are evaled to "convert C escape sequences".

- Author's write-up: https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html

```

# convert C escape sequences (allowed in quoted text)

$tok = eval qq{"$tok"};

```

### Credits

- Reported by: https://hackerone.com/reports/1154542

- Refered some code from here: https://github.com/CsEnox/GitLab-Wiki-RCE

- Author's write up: https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html

### Usage

Need install `djvumake` & `djvulibre` to work 

Install djvulibre ( if you haven't installed it yet)

```

sudo apt-get install -y djvulibre-bin

```

Run exploit

```

python3 exploit.py -t  -c 

```

Tested on version 13.10.1-ce.0