GitLab servers are being exploited in DDoS attacks in excess of 1 Tbps

CVE-2021-22204 is a code-injection flaw (CWE-95) in ExifTool, a widely used Perl library for reading and writing file metadata: versions 7.44 and later improperly neutralize user-supplied data when parsing the DjVu file format. It is triggered when ExifTool processes a crafted image or DjVu file, causing attacker-controlled input to be evaluated and executed in the context of the process doing the parsing. An attacker who can get a malicious file parsed, for example through a web service, media pipeline, or desktop application that extracts metadata from uploaded files, gains arbitrary code execution on the host. Any deployment running an affected ExifTool version that handles untrusted files is exposed, and because ExifTool is embedded inside many third-party products, affected systems may not have ExifTool visible in their inventory by name. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-17, EPSS assigns it a 100% probability of exploitation within 30 days (top percentile), and CISA's required action is to apply updates per vendor instructions.

Do: Upgrade ExifTool to version 12.38 or later wherever it is installed directly or bundled inside other software, and apply vendor-supplied patches for any third-party products that embed ExifTool. Prioritize systems that parse untrusted or user-uploaded images; as an interim mitigation, block or strip DjVu-formatted uploads and disable DjVu metadata extraction until patching is complete. Because the flaw is in CISA's KEV catalog with an active exploitation window, treat remediation as urgent and verify asset inventory for embedded copies of ExifTool.

GitLab CE/EE versions from 11.9 onward fail to properly validate image files before passing them to the bundled ExifTool file parser, enabling command/code injection (CWE-94). A remote, unauthenticated attacker triggers it by getting the server to parse a specially crafted image (e.g., through file-upload features), with no credentials or user interaction required. Successful exploitation yields arbitrary command execution on the GitLab server, exposing source code, credentials, CI/CD data, and the wider network (CVSS 10.0, scope-changed). All self-managed GitLab Community and Enterprise Edition deployments on affected versions are exposed. The flaw is actively exploited in the wild: it is on CISA's KEV with known ransomware use, public PoCs exist, and 2021 campaigns used it for ransomware, cryptojacking, and access brokering against GitLab servers.

Do: Upgrade immediately to the patched releases - 13.10.3 or later, or the corresponding 13.9.6/13.8.6/13.7.9 backports - per vendor instructions, as required for KEV entries. Until patched, restrict network access to internet-facing GitLab instances and verify the bundled ExifTool is current. Hunt for signs of compromise (suspicious processes or cron jobs, cryptominers, webshells, new SSH keys, unexpected outbound connections), given documented ransomware and cryptojacking abuse.