50% of internet-facing GitLab installations are still affected by a RCE flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-22205 | Unauthenticated RCE in GitLab CE/EE via ExifTool Image Parsing (CVE-2021-22205) GitLab CE/EE versions from 11.9 onward fail to properly validate image files before passing them to the bundled ExifTool file parser, enabling command/code injection (CWE-94). A remote, unauthenticated attacker triggers it by getting the server to parse a specially crafted image (e.g., through file-upload features), with no credentials or user interaction required. Successful exploitation yields arbitrary command execution on the GitLab server, exposing source code, credentials, CI/CD data, and the wider network (CVSS 10.0, scope-changed). All self-managed GitLab Community and Enterprise Edition deployments on affected versions are exposed. The flaw is actively exploited in the wild: it is on CISA's KEV with known ransomware use, public PoCs exist, and 2021 campaigns used it for ransomware, cryptojacking, and access brokering against GitLab servers. Do: Upgrade immediately to the patched releases - 13.10.3 or later, or the corresponding 13.9.6/13.8.6/13.7.9 backports - per vendor instructions, as required for KEV entries. Until patched, restrict network access to internet-facing GitLab instances and verify the bundled ExifTool is current. Hunt for signs of compromise (suspicious processes or cron jobs, cryptominers, webshells, new SSH keys, unexpected outbound connections), given documented ransomware and cryptojacking abuse. | 10.0 | 100% | KEV ransomware PoC ×2 |
| largetens of thousands of internet-exposed self-managed GitLab instances (order of ~50,000+ servers in public scans) |
Full article445 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 02, 2021
Researchers warn of a now-fixed critical remote code execution (RCE) vulnerability in GitLab ‘s web interface actively exploited in the wild.
Cybersecurity researchers warn of a now-patched critical remote code execution (RCE) vulnerability, tracked as CVE-2021-22205, in GitLab’s web interface that has been actively exploited in the wild.
The vulnerability is an improper validation issue of user-provided images the can lead to arbitrary code execution. The vulnerability affects all versions starting from 11.9.
“An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that is passed to a file parser which resulted in a remote command execution. This is a critical severity issue (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9). It is now mitigated in the latest release and is assigned CVE-2021-22205.” reads the advisory published by GitLab.
GitLab addressed the vulnerability on April 14, 2021, with the release of 13.8.8, 13.9.6, and 13.10.3 versions.
The vulnerability was reported by the expert vakzz through the bug bounty program of the company operated through the HackerOne platform.
The vulnerability was actively exploited in the wild, researchers from HN Security described an attack one of its customers. Threat actors created two user accounts with admin privileges on a publicly-accessible GitLab server belonging to this organization. The attackers exploited the flaw to upload a malicious payload that leads to remote execution of arbitrary commands.
“Meanwhile, we noticed that a recently released exploit for CVE-2021-22205 abuses the upload functionality in order to remotely execute arbitrary OS commands. The vulnerability resides in ExifTool, an open source tool used to remove metadata from images, which fails in parsing certain metadata embedded in the uploaded image, resulting in code execution as described here.” reads the analysis published by HN Security.
The flaw was initially rated with a CVSS score of 9.9, but the score was later changed to 10.0 because the issue could be triggered by an unauthenticated attackers.
Researchers from Rapid7 reported that of the 60,000 internet-facing GitLab installations:
- 21% of installs are fully patched against this issue.
- 50% of installs are not patched against this issue.
- 29% of installs may or may not be vulnerable.
GitLab users are recommended to update their installs immediately.
“GitLab users should upgrade to the latest version of GitLab as soon as possible. In addition, ideally, GitLab should not be an internet facing service. If you need to access your GitLab from the internet, consider placing it behind a VPN.” reads the advisory published by Rapid7.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, RCE)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/124088/hacking/gitlab-rce.html